Misconfigured Firebase instances leaked 19 million plaintext passwords