Steam Wallet API flaw