Propose a data access module immune to injection

filter_by() in sqlalchemy use key word arguments. Previously, we used filter(), which use SQL literal.

session is a global variable in this module. Every data access through this module. So the session is not spread all over our control.py.