I've been trying to create a user via webservice without doing any custom coding or curl.
This post got me 75% there: How to create test_endpoint?
I finally got it working, but only by passing in my creds with each request. CSRF token header is ignored.
I'm using the Services and Services basic authentication modules.
I do an initial GET request to services/session/token with Basic auth headers with my username/password and get the token as expected. In the next call, POST to rest/user, I have the CSRF token (HTTP_X_CSRF_TOKEN) and Content-type (application/json) and json encoded user data in the body. Instead of authenticating with the token, I get a login popup.
If instead I send the Basic auth headers with my username/password along with the create user request and json data, it works. I don't understand why CSRF is being ignored.
Edit: One other note. In testing I used both the FF RestClient and FF Poster plugins. I have not tested on Chrome.