passengerkit-api: GraphQL at /graphql, auth at /auth