Flickr account hijack flaw earns researcher $7k