Django CSRF cookie not set by JS post request - django

Question

I'm trying to build client/server system as follows: server is django REST with some database, client is static HTML/CSS/JS built as separate django project.
I've got stuck with a basic user authentication scheme processed via simple login form on client side. My idea was to go for token authentication, token to be stored in client's localStorage - so that's why I've taken approach to handle the form submit and POST for token to server by JS.
The issue is I cannot get the token from server to client due to Forbidden (CSRF cookie not set.): /getToken/ error on the server side. Spent tons of time on it and I cannot find answer why CSRF cookie is not set as I enforce at least 4 mechanisms forcing the cookie set: 1) {% csrf_token %}, 2) manual setting of cookie header, 3) #ensure_csrf_cookie, 4) removing 'django.middleware.csrf.CsrfViewMiddleware', from MIDDLEWARE_CLASSES in server settings.py ...
Here are the details:
The client part looks as follows:
login.html form:
<form name="login" method="POST">
{% csrf_token %}
Username<input type="text" name="uname"/>
Password<input type="password" name="psswd"/>
<input type="button" onclick="do_login(this.form)" value="Login"/>
<input type="reset" value="Reset"/>
</form>
where do_login() is in the script below. Pls mind the {% csrf_token %} is included ...
login_script.js :
function do_login(form) {
var csrftoken = getCookie('csrftoken');
uname = form.uname.value;
psswd = form.psswd.value;
var req = new XMLHttpRequest();
var url = "http://localhost:8000/getToken/";
var params = JSON.stringify({ username: uname, password: psswd });
req.open("POST", url, true);
req.setRequestHeader("X-CSRFToken", csrftoken);
req.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
req.onreadystatechange = function() {
if(req.readyState == XMLHttpRequest.DONE && req.status == 200) {
alert(http.responseText);
}
}
req.send(params);}
where getCookie is a copy&paste function from django tutorial (it seems to return some cookie, so I assume it's correct)
views.py:
#ensure_csrf_cookie
def user_login(request):
return render(request, 'login.html', {})enter code here
I put #ensure_csrf_cookie to force the cookie input but with no success ...
On the server side I have a view
#require_POST
def getToken(request):
serializer = AuthTokenSerializer(data=request.data)
serializer.is_valid(raise_exception=True)
user = serializer.validated_data['user']
token, created = Token.objects.get_or_create(user=user)
response = HttpResponse({'token': token.key}, content_type="application/json")
response["Access-Control-Allow-Origin"] = "*"
return response
which is basically the slightly redefined django's built-in obtain_auth_token (as I couldn't overcome CORS issue in any other way round)