auth: tighten down security on reports