Southern Water customers could view others' personal data by tweaking URL parameters