Signal app flaw allowed incoming calls to be connected without user interaction