The functionality should be always based on user roles, otherwise it could lead to potential data security issues. If there is no user authentication then anyone outside the organization who receive the file can refresh and view the updated stats. Also, if the login is locked, then you will have to ...