Return an empty array if the user does not have
permission to view the scope requested. Also a refactor
to move scope permission check and search navigation
into a library so it can be shared across the code

Changelog: fixed