Twitter fixes SMS-based account hijacking vulnerability