Flagged reports shouldn't be returned by the server

[abrahamq]

When you flag a report using the authenticated api, the flag json key is added and set to true in
properties-> report_data -> flag, but the report is still returned by the GET /reports endpoint.

It seems that if we have flagged a report then we shouldn't return it for anyone else to use it/ for it to show up on the public facing map. We could make a note that consumers of GET /reports should check this flag variable, but that seems brittle.

I think that the server should not return reports that are flagged (except maybe if we ask for them by id?)