For five days this month, password logins through Tor could land on an interception server instead of the real host.