How to Auth: Secure a GraphQL API with Confidence