Catchlist_todo

There's stuff like this all over the place:

        updated = service.update_session(session_id, user_id, data)

        if not updated:
            return '', 404

But the db exceptions file has an "etitynotfound" exception.

We should use that everywhere instead of bespoke handling for 404s all over the place.