UserProfile should not be "World readable" in multi-tenant.

<document repository="default" id="56eefb3d-...">
  <system>
    <type>UserProfile</type>
    <path>tdelprat/1323963682791</path>
    <lifecycle-state>undefined</lifecycle-state>
    <lifecycle-policy>undefined</lifecycle-policy>
    <facet>UserProfile</facet>
    <facet>HiddenInNavigation</facet>
    <access-control>
      <acl name="local">
        <entry principal="Everyone" permission="Read" grant="true"/>
      </acl>
      <acl name="inherited">
        <entry principal="tdelprat" permission="Everything" grant="true"/>
        <entry principal="Everyone" permission="Everything" grant="false"/>
      </acl>
    </access-control>
  </system>
...