don't use the user id within the versions preview call as it could be us...

...ed to access previews of another user

@schiesbn @karlitschek @LukasReschke @icewind1991 @butonic THX