get-list returns a list, really
Return an empty string instead of ZATO_NONE
Added API docs for security.get-list