Urgent 11g Reports Security Problem

I have a new installation of  Oracle Forms and Reports 11gR2 Fusion Middleware.  I'm not using Forms at all.  I have a .NET application that builds a url to launch reports from within the app.  The WLS server is configured to use the in-process WLS_REPORTS server.   I use the IIS-WebLogic plug-in in the web server for my application.  The application is open to the public and authentication is integrated with Active Directory but once authenticated there is no additional check - security within the application is data-driven, there is only a single database account used to access the oracle db.