Two students uncover security bug that could let millions do their laundry for free