Pull over push in Solidity: why paying users in a loop breaks, and how to let them withdraw with call, checks-effects-interactions, and ReentrancyGuard.