Microsoft fixes critical Hotmail password bug