My understanding is that you are correct in that the hop doesn't know the credentials to use for the connection thus Anonymous. SPN is one method. There are other methods but it depends on the way your client application handles the viewing of the report.