Is there any way to block browser access if someone knows the url to your simple API? I'm working with the permissions now, but even when they don't have permissions... they can use the schema tab to see all of my types. I'd rather obscure that.