TODO: fix bare except (just catch Unauthorized?)
Only get db object if needed.