Hi Plaban,
This is working as per design. Appending the string &SAP-CONFIG-MODE=X to the end user login URL will change to customizing mode and any user will be able to personalize the links even if Do not allow personalization is checked in WD_GLOBAL_SETTING
I think there is no way of restricting users from appending this string to the URL.
Regards,
Manju