@alexandrebodin is the ctx.state.user not populated with GraphQL (and passed back up the request chain to the middlewares?)