Secure GraphQL queries with express js, passport s