Zoom patches account takeover hole