refs #1486 we do not want to have sql statements in controller, api and plugin class. Put them in a model, makes it also better testable