cakephp 3 + Jwt + angular - 401（未经授权）

well I need send username and password for generate the token for a login, the problem always that I send from the client (angular) response with error, but when I send it from postman work fine.

In cakephp 3.

public function initialize()
{
    parent::initialize();
    $this->Auth->allow(['add', 'token', 'me']);
}
public function token()
{
        $user = $this->Auth->identify();
        if (!$user)
        {
            throw new UnauthorizedException('Invalid username or password');
        }
        $this->set([
            'success' => true,
            'data' => [
                'user_id' => $user['id'],
                'token' => JWT::encode([
                    'sub' => $user['id'],
                    'exp' =>  time() + 604800
                ],
                    Security::salt())
            ],
            '_serialize' => ['success', 'data']
        ]);
    }

in angular how I send it

$scope.doLogin = function()
        {
            dataLogin = {
                username: vm.username,
                password: vm.password
            };
            console.log(dataLogin);
            // call the Auth.login() function
            //$scope.processing = true;
            $scope.error = '';

            Auth.login(dataLogin)
                .then(function(data) {
                    if (data.success)
                        $state('home');
                    else
                        console.log(data);
                        $scope.error = data.message;
                });
        };

and

authFactory.login = function(dataLogin) {
                return apiService.request('POST', '/api/users/token', dataLogin).then(function(data) {
                        AuthToken.setToken(data.token);
                        return data;
                    });
            };

apiService for app angular

(function(){
    angular
        .module('appDekma')
        .factory('apiService', apiService);

    apiService.$inject = ['$http'];
    function apiService($http) {
        return {
            request: sendRequest
        };

        function sendRequest(method, endpoint, data) {
            var API_HOST = 'http://localhost/dekma_backend';

            var req = {
                method: method || 'GET',
                url: API_HOST + endpoint,
                data: data || '',
                headers: {
                    'Accept': 'application/json',
                    'Content-Type': 'application/json',
                    'Access-Control-Allow-Origin' : '*',
                    'Access-Control-Allow-Headers': 'Accept, Authorization, Cache-Control, Content-Type, X-Requested-With, x-csrf-token',
                    'Access-Control-Max-Age': '3600'
                }
            };
            return $http(req)
                .then(successCallback, errorCallback);

            function successCallback(response)
            {
                return response.data;
            }
            function errorCallback(error) {
                var message = 'Something terrible happened!';
                if (error.data && error.data.code)
                {
                    switch (error.data.code)
                    {
                        case 500:
                            break;
                        case 401:
                            break;
                        case 403:
                            break;
                        case 404:
                            message = 'Could not find content';
                            break;
                        default:
                            break;
                    }
                }
                return error.data;
            }
        }
    }
})();

angular.module('app').config(['$routeProvider', '$httpProvider', function ($routeProvider, $httpProvider, urls) { 

    $httpProvider.interceptors.push(['$q', '$location', '$localStorage', function ($q, $location, $localStorage) {

        return {
            'request': function (config) {
                config.headers = config.headers || {};
                if ($localStorage.token) {
                    config.headers.Authorization = 'Bearer ' + $localStorage.token;// JWT token stored in localstorage
                    config.headers.Accept = 'application/json';
                }
                return config;
            },
            'responseError': function (response) {
                console.log(response);
                if (response.status === 401 || response.status === 403 || response.status === 500) {                    
                    var login_url = urls.BASE+'users/login';

                }
                return $q.reject(response);
            }
        };
    }]);


    $routeProvider
    .when('/', {
        templateUrl: "public/html/" + 'your_html_page.html',
        controller: 'your_anuglar_controller'
    })
    .otherwise({ redirectTo: '/' });


}]);

<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.2.23/angular.min.js"></script>

</div>