No state exchanges have fully operational IT capabilities, GAO says