This avoids passing around the reported_user via forms. There was no validation anywhere that the reported_user corresponded to the object being reported. This approach removes those worries too.