The createContext is called for every request, yes? Should be able to return a context that indicates signed in or signed out. That’s where I inspect auth headers/cookies to determine the same…
The createContext function is called for each incoming request, so here you can add contextual information about the calling user from the request object.