move symmetric decryption of docs to be db-based too