Added more tests for more subtle cases.

Also, some fixes to NodeStory (it inserts ngrams when saving node
story, when they don't exist).

This commit partially undo the access policy checks for the
GraphQL endpoints, until we find a better story to correlate
the `user_id` we sometimes receive with the info from the
`AuthenticatedUser`.

Tests were written with a very flat module hierarchy which made them
a bit confusing to navigate. This commit moves everything under a common
`Test.*` hierarchy.