Free by Design: On the Feasibility of Free-Riding Attacks Against Zero-Rated Services