The cUrl call is using login: TEST, password: TEST. Your code is using login: Test, password: Test. Those are two different sets of credentials, and the error you're getting suggests that's the issue.
(disclosure: CFJones & I worked through this offline, and this was the answer we arrived at)