Resolve "Remove CSRF on GraphQL API, rethink authentication/cookies" See merge request inject/backend!308