Elsevier embeds a unique code in every academic journal article users download. Security researchers fear this could be used to identify people who share PDFs.