Custom User Data

@esoergel @twymer
you might be able to push that to the spec too...

```python
if not self.spec.user_can_access_report(user):
   raise Http403
```