Researcher earns $15,000 bounty from Facebook for discovering massive password security hole exposing 1.1 billion accounts to a possible account takeover.