Securing a DoD contractor: Finding a multi-tenant authorization vulnerability