Need help with reporting service security

I have been assigned a task- to find out if the following is possible:

A user logs in to a web page with many tabs. One of the tabs is to view reports. The user credentials is stored in the session. When clicking the tab to view the reports, we want to redirect the user to the Report Manager screen with the encrypted url that contains the user's credentials as well.
We need the credentials because we don't want the user to see all the available reports.

Is there any way to decrypt this URL? Or is there a better way to do this (besides using SSL..)?

Any advise is appreciated!!

Thank You.