don't use the user id within the versions preview call as it could be us...

...ed to access previews of another user

backport of #6864 to stable6