Encapsulate user information in gql

[dataO1]

currently requests return the full user object, which contains the token.
From a security standpoint thats nonsense.
Define the return types, such that only publicly available user information can be visited!