abstract from sql.DB vs sql.Tx

Now we can use get_user/get_otp without having to open a transaction
each time (which also fixes a leak of transactions if an error occurs).