GraphQL with external authentication