Sorry if this wasn't clear.

You should be calling `vouchers.fetch &block` here.  `do_fetch` is the internal implementation, `fetch` checks the security then calls `do_fetch` for you.