Microsoft promises more bug payouts, with or without a bounty program