always unserialize rights array directly comming from the db