We will need a way for users to test their graphql queries. We can probably ensure that cookies are open to subdomains and the API server will work, but we may have to add some middleware to the api server which is not ideal. Also this is dependent on this pending issue (which is not a big deal and can be done in a few minutes).
Another option is to make a graphql handler directly on the links service which requires the user to be authenticated and submits queries as the logged in user automatically, using links.Execute like the other handlers.
Peter Sanchez referenced this ticket in commit 936fea3.