Twitter urges users to change 'unmasked' passwords