You might need to set the SINGLESIGNON parameter in your rwservlet.properties file to NO, as its default value is YES..
This is the default location of such file:
There are other security changes you could need to apply. Take a look at these articles:
<a href=”http://www.rittmanmead.com/files/quick_start_guide_oracle_reports.html”>Quick Start Guide to Oracle Reports Server</a>
<a href=”http://download.oracle.com/docs/cd/B14099_19/bi.1012/b14048/pbr_sso.htm#i1008966″>11.3.1 Enabling and Disabling OracleAS Single Sign-On and Reports Server Security</a>