Google patches 'loophole' in two-factor verification system