Bugfixes in are_readable

- fix SQL injection vulnerability
- was throwing errors on any shock response other than 2xx including 400, 401. Should just return 0 in those cases
- check expected DB record count vs actual, if < return 0 (nonexistent ids)