Check the user's access right when creating a chargeback report by tag.

Chargeback reports are based on the metrics tables.  The metrics tables don't have owners or tags, they point to the VM that the metric is for. To create a chargeback report that lists only the VMs (or other records) that belong to the user, we would have to disqualify metrics records based on the owner of the VM that the metrics records are pointing to. 

https://bugzilla.redhat.com/show_bug.cgi?id=1138234
This might be an N+1, but I'm not sure what the group-vm relationship looks like.