Use db.session or session properly.