Allow staff to access user api token with graphql