WhatsApp security bug lets users bypass new privacy controls