Twitter says bug exposed user plaintext passwords