Two access-control hacks drained $1.4M this month - the one-line bug, and the check that catches it

In the last few weeks two protocols were drained through the same class of bug: an access-control...