Web Authorisations

During testing - we have noticed that the authorisations created in the Bex Analyser are not being utilised when using web queries.

For example, all of the authorisations I have created using S_RS_COMP etc to restrict users to certain infoareas, cubes etc do not apply when a user opens a view in a web report..a Finance user can see and execute all of the views created in the HR area.

This does not happen when using the Bex analyser with Excel.

Am I correct in assuming that the S_RS_COMP authorisation object should apply to both Bex and web reporting?