Make sure the user in session sees only his personal pages and can not access the user pages of others.
Change paths to personal pages from internal/user/userid
/personalpage
to internal/user/personalpage
and only use the sessions uid internally to get the correct userid.
Also disable the userid given to navbaricon for userendpoints, because it became obsolete.