protect app folders except ui
use reference to the db object