Origins returned an error when no JWT subject was present, which
propagated null through the non-nullable list and killed the whole
FindEvents query. Mirror Events behavior and return an empty list
instead so partial-auth requests still render events.