We need to make sure a user can't confirm the existence of a user with private visibility * Follow up on #21533 ### Before #### User  #### Admin  ### After #### User  #### Admin  Signed-off-by: Yarden Shoham <[email protected]> Co-authored-by: wxiaoguang <[email protected]> Co-authored-by: Lunny Xiao <[email protected]>