I would argue that the root issue you're describing which leads to XSS on the same host is allowing un-sanitized input leading to code injection. It is entirel

I would argue that the root issue you're describing which leads to XSS on the same host is allowing un-sanitized input leading to code injection. It is entirely possible to design your own application which uses unique userdirs without using any of Apache's built in functionality that are completely immune to XSS because it is not possible for any of the users to place malicious scripts on the server. Likewise it is also entirely possible to build a web app that doesn't use userdirs at all in any form for anything and still be vulnerable to XSS because of underlying input sanitization or code injection problems. So whatever you're going to do, just do your homework and do it well.