The problem went away when I cleared my cookies.
In NodeBB v2, I was using this API call to get a token for the current user by passing their password:
"/api/v2/users/" + userId + "/tokens"
When I tried to upgrade it to v3, I now get a response saying "forbidden":
"/api/v3/users/" + userId + "/tokens"
Did something change besides the version in the API call?