putting auth in the report controller, for real