Use an EmptyQuerySet for unauthenticated users.