add back raw SQL query (it had an appropriate ACL)