New York State fixes vulnerability in COVID-19 passport app that allowed storage of fake vaccine credentials