add db parameters and connection setup in handler
GET and POST handlers separated
refactor, add token-used-p function
mark token as used upon POST