React query and auth: Who is responsible for what?