add security check to code that changes db - this file may not be needed?