@MichelDiz thanks for the answer! 
I’ve tried all day to get this working today.
I have now found a way to run the login(userId: "", password: "", namespace: 1) query from the Tenant-0 because this is the only namespace I have access to from outside the Cloud interface. I do this because I don’t want to expose the Admin Key in my application! It’s weird but at least this seemed to work and I could query the other namespace from my app.
The next problem I ran into was that my custom lambda stopped working with the error message that no access JWT has been submitted! So it seems that the X-Dgraph-AccessToken header is not getting forwarded to the internal dql.mutate and dql.query functions! How would I do this? The actual error message I get is:
"rpc error: code = Unauthenticated desc = no accessJwt available"
I have further noticed that if I run queries (in my namespace) from the GraphQL tab, including my custom Auth header, it result in a “Network Error”. Investigation of the network tab in the browser shows that it’s because of a CORS error! What is going on here?