[MOV] Move ensure_db() helper from

Since we removed auth="admin" in favor of auth="none" with explicit superuser id usage,
the disable_db clause in ir_http#...auth_none() has only sense for /web and /web/login routes.
The web module is an exception because it's routes are registered for the nodb dispatching.
This is why the ensure_db() helper is moved to web client and will take care of the
web's auth="none" routes that needs a db to work with
[FIX] ensure db param is legit in order to avoid xss