returns an empty list when not logged in