Afterpay's 'buy now, pay later' is built on a legal loophole