contractually, we probably want to either raise an exception in the constructor if there is no user or return a blank array here `if @user.nil?`