Make sure the user in session sees only his personal pages and can not access the user pages of others.
Change paths to personal pages from internal/user/
userid
/
personalpage
to internal/user/
personalpage
and only use the sessions uid internally to get the correct userid.
Also disable the userid given to navbaricon for userendpoints, because it became obsolete.