Account takeover via short-lived token email change

Improper authorization in Wire iOS before 3.86 allows remote attackers with an old valid access token to take over an account. The client sends an email-change request to the /self/email endpoint using only the short-lived token in the Authorization header, without the long-lived authentication cookie. Possession of an old but still valid token is required; changing the account email transfers control of the account.