return empty array if user is not logged in