Had to solve it via a Plugin. So the Private URLs from the initial post are working now.

Has to be a problem in ENFOLD writing wrong iframe code (or no iframe-code at all…)

Should be fixed. Sucks.