PayPal rejects report that exposed critical account takeover vulnerabilities