Security flaws in a popular GPS tracker are exposing a million vehicle locations