How does GraphQL fix the problem of showing different fields depending on rights?