Actually bail if db not present. Fixes #4.

@jedp or @seanmonstar, mind having a look?

Hmm. arguably if the DB is gone we should return a 500 every time?

Ah well. This preserves current behavior, minus one bug I found (#4) and another I didn't (when you try to DELETE a user programmatically and the DB is gone, same badness).

res.json/res.send means res is done, but the function continues, does db.foo() where db is null, and, f7u12.