return empty cursor list if user isn't admin