Dropbox confirms security glitch--no password required