Changes @Transactional to be method-level.

No point in having @Transactional annotation at class-level,
since there's only one method that modifies database state.
Added auth annotations to ReportController.