API: some comments
DB: now checks user permissions.
also: new DB struct format.