Do not copy db session for each operation

Instead of copying the db session, we leave that responsibility to the caller. This allow credentials to be properly managed.