[dang]

Ok, I've updated the title above to that (shortened a bit to fit HN's 80 char limit). Thanks!

(Submitted title was "Microsoft Account's OAuth tokens leaking via open redirect in Harvest")