How a Tarte Cosmetics database leak exposed personal info for nearly 2 million customers. The problem: User error involving misconfigured Mongo database.