XServe AFP allows any user to access any share point

I'm trying to set up an XServe to allow users to access their home folder remotely over the Internet. I do not want users to be able to access folders not their own. Unfortunately, any user I set up ends up having access to any share point, no matter what I do. How do I restrict access to only the assigned folder? Chris