- remove unused auth decorator
- do it the py3 way
- wrap sessions in try/finally blocks
- make sure new transactions maintain keep the user's schema in the search path