FIX: return empty json box [] if not logged in rather than sending to login page for API calls.