A couple API questions

I’m currently working on a desktop viewer for Derpibooru (Repo), and pretty much everything works, except a few things I couldn’t find in the docs:
 

Regarding 2 and 3, I think you’ll find your browser’s dev tools to be very helpful. By having the network panel open and interacting with the site, you can inspect the network request and response headers and figure things out from there.

@Background Pony #A5C5  
At a glance, up- and downvoting, as well as faving, require you to be logged in. The network panel doesn’t tell me how to send the token (or if token can even be used for authorization, for that matter). I see a cookie and a token that looks nothing like the regular user token being used for the request, but that’s about it.

With fave and vote interactions, I think you can send the token in the key field (see Accessing the API section). The network panel should tell you the rest.
 
If you have the user give you their email and password, you might as well masquerade as a browser, fill in the login form, capture the cookies, navigate to the account page, and parse the token out.

 
There’s something I’m missing, or calls from resttest.com are blocked by Derpibooru. Managed to pull the endpoint url from DeliciousBlackLink’s abandoned Android app’s code, and it also seems that the parameters I’m passing were being passed by that app as well. Nevertheless, I’m getting HTTP 0 error.  
I’ll try changing the endpoint to be similar to how the documented endpoints look, maybe they’re changed.

Update: Insomnia (an application for sending REST requests, not the medical condition lol) finally gives me something to work with, the error is Invalid or missing CSRF token, so it’s all about the cookies.

Update: So I managed to get some cookies by parsing the login page with Xpath and sending a POST request, but they don’t seem to be the right kind, as trying to upvote posts with them passed in header results in 403 Forbidden.
 
The good thing is, we all can sleep safely knowing, that Derpibooru is secure as fuck. Or at least secure enough for me to not be able to do anything besides what the public API allows.
 
The bad thing is, well, I’m not able to do anything besides what the public API allows. And it’s pretty much limited to fetching stuff only, so no upvoting, no downvoting, no adding to favourites, nothing of the sorts.