Abusing Constrained Delegation — ExplainTheHack