most app stuff should be read-only in request context