server-side config JSON with cjson
db.is_valid_user