move all database-writing logic into methods and stop using allow()