I'm guessing that behind the scenes graphcool drops down to "anonymous" authorisation if the token fails... does that sound right?