Secure mod-graphql against malicious queries

This is something we should be aware of as we start to move towards production: the extreme expressiveness and power of GraphQL makes it very easy to construct queries that will consume resources and result in a DoS. See the fine overview of approaches at https://dev-blog.apollodata.com/securing-your-graphql-api-from-malicious-queries-16130a324a6b