Based on the initial design, test report should be visible without logon, and for any user.
And the related configuration is in "applicationContext-security.xml". But now, it is incorrect because of the URL style is changed.
So, it should be as initial function design. And if this function need to be modified, should mention it explicitly in JIRA or else.