Right now when GraphQL is enabled in a Server instance, the /graphql route is exposed. Not a huge deal but this should be optional.
Peter Sanchez referenced this ticket in commit 9f6e2ce.