Facebook users may have to hand employers their passwords