removed insecure so no direct database calls are made from the client side