This adds the author and merged_at fields to the graphql API.

The authorize field service is changed to support arrays of lazy values,
which is a bug that had gone unnoticed.