get all sites requires a logged-in session