Invert control of database deletion.

Handle failure properly by producing a 500