About half of popular websites tested found vulnerable to account pre-hijacking