GAO points to airport security holes