Unless specified in your settings.php as a regex string.. ($conf['restws_basic_auth_user_regex'] = '/^ws_.*/';)
restws requires your username to start with restws, so restws_test or something.
Referencing the conversation https://www.drupal.org/node/1664352
A Drupal site uses it's own authentication - and therefore does not issue an 'HTTP AUTH needed here' type header.
Tools like Poster and wget do not send the HTTP AUTH credentials you've supplied unless the site asks for them - and Drupal doesn't. So because the credentials are not sent the restws_auth_basic module does not have them to use to login in to the Drupal site.
So - for wget - add the '--auth-no-challenge' switch to get wget to sent the credentials anyway. I.e.
$ wget --user=ws_user1 --password=xxxxx --header="Accept: application/xml" --auth-no-challenge -O - http://www.example.com/node/1
Also, curl seems to send the credentials without an extra switch being added - i.e.
$ curl --user ws_user1:xxxxxx --header "Accept: application/xml" http://kbailey.icmsv4.dev3/node/1
If your using postman..
I suggest you enable interceptor... this basically means for testing you can log in to your site as usual and this will be stored in session cookies, which interceptor enables accces to.
When already logged in, youll find you can post to restws/session/token happily and get the csrf token in response.