Microsoft should disable device-code authentication by default