Somebody else's report is a 404, and the user id is in the where clause rather than in an if

Four small decisions behind one private URL: ownership in the query, not-found rather than forbidden, a robots tag on a page no crawler can reach anyway, and why the page is force-dynamic.