A client should authenticate first, capture the resulting user and school
context, and then use that context when calling GraphQL or other supported
resources.
Treat returned user and school context as operationally important. Many follow-up
flows depend on knowing which school, role, year, and term the current user is
working inside.