DQL queries need to respect GraphQL @auth rules

You can use another service to restrict access to your restricted endpoints if you are using self-hosted. You could even setup similar to Slash on a self-host by creating a auth layer between dgraph and the world. Check out what @dmitry did here: