Top websites keep letting people use weak passwords like 111111, and it’s a major security risk