fix(api/graphql): fix permissions fallbacks

Changes fallback rules to deny instead of the incorrect false.
Also requires an upgrade from coko server to get this fix from graphql-shield to make things work