I found after some experimenting that the above code works on the second POST. The first request always fails with a 401, but the second request will pass.
Not sure why that is happening, but I am going to move on for now and assume it is not a FusionAuth issue.