Use Auth to prevent others to update stats, and use the DB