thumbnail Okta security bug affects those with really long usernames