Guarding GraphQL: Strategies for Robust API Authorization