@auth directives don't apply to nested objects when using interfaces?

[elhil]

@MichelDiz what do I need to do to have this accepted as a bug? It’s a critical security flaw that could keep us from putting dgraph into production. At minimum we’ll have to refactor a lot of code.