Facebook must face data breach class action on security, but not damages: judge