moved from BasicAuth to SessionAuth
catch potential db errors