Credential stuffing explained: How to prevent, detect and defend against it