move db connection code into _signin()