[benawad]

1. Create a login mutation which creates a session and sends back a cookie.

2. Use resolver middleware to check whether the user is authenticated.

I like to use express-session (https://github.com/expressjs/session) for part 1 and graphql-middleware (https://github.com/prisma/graphql-middleware) for part 2.