Check for `report.user.id != request.user.id` instead of where  display_name (which is set in url) matches the display_name of the report to be edited. This can be easily circumvented.