Researcher nets $20K for finding serious Facebook flaw