allow /report.csv, in case browsers don't add the extension automatically