Use duplicate user to run reports.

This avoids concurrency issues when emailing reports, particularly
if the object report also generates a sign up token for a partner!

This also means we can use the report in systems with password
encryption turned on.

Fixes #149.