Government auditors set up 24 fake accounts to see whether the agency administering Obamacare would detect them - and the agency flunked.