Hacky fix

I had to remove admin_required from the reporting variables so I could
list either way before the $3k step... this should be the only place I
need to implement this code...
Set permitted variable

This will stop anyone not able to see buttons from refreshing through
the steps + seeing buttons in the first place