we generally do it in that order because without permissions access, the item being the database (if your code is properly checking) doesn't really matter