first stab at a design where each incoming API call has its own dbsession