JS POST setting new password with save-user re-submission not working with returned CSRF token

I have an AJAX form that sets a new password (using users/save-user) for the current logged in user (not an admin). It works for the first time but when I re-submit with the new token, a 400 Bad Request error is returned. Here are the 2 requests:

POST Header (first time):

CRAFT_CSRF_TOKEN: <token obtained on page load via {{ craft.app.request.csrfToken | e('js') }}>
action: users/save-user
currentPassword: <current password>
newPassword: <new password>
userId: <id>

Post Response (first time):

csrfTokenValue: <new token>
id: <id>
success: true

POST Header (second time):

CRAFT_CSRF_TOKEN: <new token (as obtained in the above response)>
action: users/save-user
currentPassword: <current password>
newPassword: <new password>
userId: <id>

Post Response (second time):

error: "Unable to verify your data submission."
exception: "yiiwebBadRequestHttpException"
file: "./craft/vendor/yiisoft/yii2/web/Controller.php"
line: 209
trace: <array>

I’m thinking I might need to update the CSRF browser cookie but can’t find anything documented. Can anyone help?

Thanks!