moved db call back into its own module. for some reason, when there was an
uncaught error when the client made an api call, it showed up as a CORS error
on the client side, even though CORS was enabled