Android NFC hack lets subway riders evade fares