Abusing HTTP Status Codes to Expose Private Information