I think the problem you're having can be explained by looking at the 2 ways of embedding a visualization iframe.
In this screenshot of the Sharing panel in a visualization on the left side we have the embedded iframe for the saved visualization
. It uses the guid of the saved visualization. This URL does not contain my filter string "init" (representing your user "foobar"). That filter string is saved in the visualization itself. If you used this iframe and I made a change to the visualization you would see the change. This iframe link is 318 characters long.
<iframe src="https://localhost:5601/app/kibana#/visualize/edit/abe2c120-1f87-11e7-a7cc-fbe9a87ddb8f?embed=true&_g=(refreshInterval%3A(display%3AOff%2Cpause%3A!f%2Cvalue%3A0)%2Ctime%3A(from%3A'2017-04-11T18%3A41%3A25.557Z'%2Cmode%3Aabsolute%2Cto%3A'2017-04-11T18%3A42%3A01.198Z'))" height="600" width="800"></iframe>
On the right side we see Share Snapshot Embedded iframe
. This URL builds the matching visualization instead of referencing the visualization saved in the Kibana index. The URL does contain my filter string "init" and a proxy could modify it. This iframe link is 1807 characters long.
<iframe src="https://localhost:5601/app/kibana#/visualize/edit/abe2c120-1f87-11e7-a7cc-fbe9a87ddb8f?embed=true&_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:'2017-04-11T18:41:25.557Z',mode:absolute,to:'2017-04-11T18:42:01.198Z'))&_a=(filters:!(),linked:!f,query:(query_string:(analyze_wildcard:!t,query:'*')),uiState:(spy:(mode:(fill:!f,name:table))),vis:(aggs:!((enabled:!t,id:'1',params:(field:system.process.cpu.total.pct),schema:metric,type:avg),(enabled:!t,id:'2',params:(customInterval:'2h',extended_bounds:(),field:'@timestamp',interval:auto,min_doc_count:1),schema:segment,type:date_histogram),(enabled:!t,id:'3',params:(filters:!((input:(query:(query_string:(analyze_wildcard:!t,query:'system.process.name:init'))),label:''),(input:(query:(query_string:(analyze_wildcard:!t,query:'system.process.name:*')))))),schema:group,type:filters)),listeners:(),params:(addLegend:!t,addTimeMarker:!f,addTooltip:!t,categoryAxes:!((id:CategoryAxis-1,labels:(show:!t,truncate:100),position:bottom,scale:(type:linear),show:!t,style:(),title:(text:'@timestamp+per+second'),type:category)),defaultYExtents:!f,drawLinesBetweenPoints:!t,grid:(categoryLines:!f,style:(color:%23eee)),interpolate:linear,legendPosition:right,radiusRatio:9,scale:linear,seriesParams:!((data:(id:'1',label:'Average+system.process.cpu.total.pct'),drawLinesBetweenPoints:!t,interpolate:linear,lineWidth:2,mode:normal,show:!t,showCircles:!t,type:line,valueAxis:ValueAxis-1)),setYExtents:!f,showCircles:!t,times:!(),valueAxes:!((id:ValueAxis-1,labels:(filter:!f,rotate:0,show:!t,truncate:100),name:LeftAxis-1,position:left,scale:(mode:normal,type:linear),show:!t,style:(),title:(text:'Average+system.process.cpu.total.pct'),type:value))),title:'New+Visualization+init+vs.+all',type:line))" height="600" width="800"></iframe>
And the dashboard sharing works in a similar way. The Share saved dashboard Embedded iframe
URL uses the guid of the saved dashboard and changes to that dashboard (like adding or removing a visualization) would be reflected in the embedded iframe.
And the Share Snapshot Embedded iframe
contains the explicit list of visualizations and so it would not change if I changed the saved dashboard. But this is including the Saved Visualizations, not the Snapshot Visualizations.
If it contained all of the Snapshot Visualizations then it would have your "foobar" user link in each visualization. But it would also get extremely long and I'm not sure what length limits it would hit. Certainly it would be a problem on Internet Explorer.