MCP Python SDK OAuth flaw enabled account takeover | Hacker News Reader