Tweaking a URL for requested FERPA files revealed others’ Common Application essays, transcripts with Social Security numbers and more