'ProxyToken' bug allowed attackers to reconfigure Exchange m