Major LastPass security bug puts millions of accounts at risk