US consumer bureau orders fintech firm LendUp to halt new loans, pay penalty