Facebook bug let apps access millions of unauthorized photos