They'll only see this if someone without permission to do so manually edits the URL to show someone else's username.  The result will be a blank page with the words "HTTP 403 - CLIENT ERROR - PERMISSION DENIED: You can only view your own report".
Is this acceptable?
Maybe I should sync django-no-exceptions with a template or our normal permission denied process.