After Fabien's changes, this needed amendment.

Also, some test refactoring and add servant-client to tests.

This commit modifies the backend code to convert the input CSV into an
`NgramsList`, so that we can reuse the JSON API for the upload.

This commit partially undo the access policy checks for the
GraphQL endpoints, until we find a better story to correlate
the `user_id` we sometimes receive with the info from the
`AuthenticatedUser`.