Two iOS fitness apps tricked users into making TouchID payments