Twitter flaw gave third-party apps unauthorized access to private messages, researcher says