Test authorizations in GraphQL Mutations

After !30958 (merged) we can test the authorizations within mutation specs. We should add these to tighten our testing in these areas.