Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions