Almost every new smartphone now lets you unlock it with your face — and that’s really bad for security.