FlowCmdM -> DBCmd or HasNodeStory is usually enough

- DBCmd instead of Cmd
- remove FlowCmdM in favor of HasNodeStory

This commit partially undo the access policy checks for the
GraphQL endpoints, until we find a better story to correlate
the `user_id` we sometimes receive with the info from the
`AuthenticatedUser`.

This commit partially undo the access policy checks for the
GraphQL endpoints, until we find a better story to correlate
the `user_id` we sometimes receive with the info from the
`AuthenticatedUser`.

This commit partially undo the access policy checks for the
GraphQL endpoints, until we find a better story to correlate
the `user_id` we sometimes receive with the info from the
`AuthenticatedUser`.

This commit makes the `GET /api/v1.0/version` test more lax, and less
prone to break on version bumps.

It can be used to "bolt-on" policy checking into Servant API routes.