remove parameter user_id in URL and fix security bug: A can view B folder without share