/devices only return devices the user is authorized to view