After playing around using postman I found the issue.
When sending a Bearer: "" or Bearer: "xxxxxx" token, the server returns "Authentication Required".
But when sending no Bearer token or an empty Bearer: it works fine.
So when logging in; no token must be supplied else it tries to authenticate against that token instead of correctly generating a new one provided you submitted valid credentials in the JSON body.
Seems a bit odd to me, but ok.