Allow users to only see themselves (@auth)

[repomaa (Joakim Repomaa)]

I had the exact same problem. The weird thing is: if i encode the username in the token instead of the id and use that in the auth query, it works.