graphiql doesnt work: "Cannot serve request to /content/graphiql/ in org.apache.sling.servlets.get.DefaultGetServlet"

I installed graphiql according to this article

Here we can see the package is installed:

But when I go to the required url:

http://localhost:4502/content/graphiql.html

I get:

Forbidden

Cannot serve request to /content/graphiql/ in org.apache.sling.servlets.get.DefaultGetServlet

I am installing on a fresh instance of the AEM cloud SDK, with a clean install of the wknd site directly from git (which has grapql endpoint configured etc)

Any ideas? The tutorial has no additional configuration that I can see.

I also tried "reinstall"

Here is the complete output.

Request Progress:

      0 TIMER_START{Request Processing}
      4 COMMENT timer_end format is {<elapsed microseconds>,<timer name>} <optional message>
     21 LOG Method=GET, PathInfo=null
     27 TIMER_START{handleSecurity}
   1584 TIMER_END{1555,handleSecurity} authenticator org.apache.sling.auth.core.impl.SlingAuthenticator@5e5d7787 returns true
   1866 TIMER_START{ResourceResolution}
   1977 TIMER_END{109,ResourceResolution} URI=/content/graphiql.html resolves to Resource=JcrNodeResource, type=graphql/components/graphiql, superType=null, path=/content/graphiql
   1986 LOG Resource Path Info: SlingRequestPathInfo: path='/content/graphiql', selectorString='null', extension='html', suffix='null'
   1986 TIMER_START{ServletResolution}
   1989 TIMER_START{resolveServlet(/content/graphiql)}
   2008 TIMER_END{17,resolveServlet(/content/graphiql)} Using servlet org.apache.sling.servlets.get.DefaultGetServlet
   2011 TIMER_END{24,ServletResolution} URI=/content/graphiql.html handled by Servlet=org.apache.sling.servlets.get.DefaultGetServlet
   2017 LOG Applying Requestfilters
   2069 LOG Calling filter: com.adobe.granite.resourceresolverhelper.impl.ResourceResolverHelperImpl
   2085 LOG Calling filter: org.apache.sling.security.impl.ContentDispositionFilter
   2091 LOG Calling filter: com.adobe.granite.csrf.impl.CSRFFilter
   2100 LOG Calling filter: org.apache.sling.i18n.impl.I18NFilter
   2105 LOG Calling filter: com.adobe.granite.httpcache.impl.InnerCacheFilter
   2118 LOG Calling filter: org.apache.sling.rewriter.impl.RewriterFilter
   2124 LOG Calling filter: com.adobe.cq.history.impl.HistoryRequestFilter
   2405 LOG Calling filter: com.day.cq.wcm.core.impl.WCMRequestFilter
   2429 LOG Calling filter: com.adobe.cq.wcm.core.components.internal.servlets.CoreFormHandlingServlet
   2437 LOG Calling filter: com.adobe.granite.optout.impl.OptOutFilter
   2448 LOG Calling filter: com.day.cq.wcm.foundation.forms.impl.FormsHandlingServlet
   2458 LOG Calling filter: com.adobe.cq.wcm.core.extensions.amp.internal.AmpModeForwardFilter
   2664 LOG Calling filter: com.day.cq.dam.core.impl.servlet.DisableLegacyServletFilter
   2673 LOG Calling filter: org.apache.sling.engine.impl.debug.RequestProgressTrackerLogFilter
   2678 LOG Calling filter: com.day.cq.wcm.mobile.core.impl.redirect.RedirectFilter
   2685 LOG Calling filter: com.day.cq.wcm.core.impl.AuthoringUIModeServiceImpl
   2882 LOG Calling filter: com.adobe.granite.rest.assets.impl.AssetContentDispositionFilter
   2891 LOG Calling filter: com.adobe.granite.requests.logging.impl.RequestLoggerImpl
   2907 LOG Calling filter: com.adobe.granite.rest.impl.servlet.ApiResourceFilter
   2951 LOG Calling filter: com.day.cq.dam.core.impl.servlet.ActivityRecordHandler
   2969 LOG Calling filter: com.day.cq.dam.core.impl.assetlinkshare.AdhocAssetShareAuthHandler
   2978 LOG Calling filter: com.day.cq.wcm.core.impl.warp.TimeWarpFilter
   2993 LOG Applying Componentfilters
   2996 LOG Calling filter: com.day.cq.personalization.impl.TargetComponentFilter
   3001 LOG Calling filter: com.day.cq.wcm.core.impl.page.PageLockFilter
   3007 LOG Calling filter: com.day.cq.wcm.core.impl.WCMComponentFilter
   3149 LOG Calling filter: com.day.cq.wcm.core.impl.monitoring.PageComponentRequestFilter
   3154 LOG Calling filter: com.day.cq.wcm.core.impl.WCMDebugFilter
   3163 TIMER_START{org.apache.sling.servlets.get.DefaultGetServlet#0}
   3177 LOG No renderer for extension html
   3198 LOG Applying Error filters
   3200 LOG Calling filter: org.apache.sling.i18n.impl.I18NFilter
   3203 LOG Calling filter: org.apache.sling.rewriter.impl.RewriterFilter
   3212 TIMER_START{handleError:status=404}
   3241 TIMER_END{27,handleError:status=404} Using handler BundledScriptServlet (/libs/sling/servlet/errorhandler/404.jsp)
   5984 LOG Found processor for post processing ProcessorConfiguration: {contentTypes=[text/html], order=-1, active=true, valid=true, processErrorResponse=true, pipeline=(generator=Config(type=htmlparser, config={}), transformers=(Config(type=linkchecker, config={}), Config(type=mobile, config=JcrPropertyMap [node=Node[NodeDelegate{tree=/libs/cq/config/rewriter/default/transformer-mobile: { jcr:primaryType = nt:unstructured, component-optional = true}}], values={jcr:primaryType=nt:unstructured, component-optional=true}]), Config(type=mobiledebug, config=JcrPropertyMap [node=Node[NodeDelegate{tree=/libs/cq/config/rewriter/default/transformer-mobiledebug: { jcr:primaryType = nt:unstructured, component-optional = true}}], values={jcr:primaryType=nt:unstructured, component-optional=true}]), Config(type=contentsync, config=JcrPropertyMap [node=Node[NodeDelegate{tree=/libs/cq/config/rewriter/default/transformer-contentsync: { jcr:primaryType = nt:unstructured, component-optional = true}}], values={jcr:primaryType=nt:unstructured, component-optional=true}]), serializer=Config(type=htmlwriter, config={}))}
   6278 TIMER_END{6276,Request Processing} Dumping SlingRequestProgressTracker Entries