'Insensitive' phishing test stirs debate over ethics of security training