there is a nonzero chance that created_on might not always return a valid datetime. i guess we'll find out if we see any 500s, but this would lock someone out of viewing any reports. then again, not sure how much defensive programming clutter we want to introduce into the codebase for scenarios like this.