A serious flaw in the Download Your Data tool means passwords were exposed in URLs – but the issue has now been patched.