replace User.update_device with safe db access