This commit partially undo the access policy checks for the
GraphQL endpoints, until we find a better story to correlate
the `user_id` we sometimes receive with the info from the
`AuthenticatedUser`.

Tests were written with a very flat module hierarchy which made them
a bit confusing to navigate. This commit moves everything under a common
`Test.*` hierarchy.