Should a BCAAA server be located closer to the proxy or the Domain Controller?