Allow WWW-Authenticate header to be accessed by client

[cliffhall]

• In server/src/index.ts
  • Add www-authenticate to Access-Control-Expose-Headers list for responses.

Motivation and Context

When a 401 Unauthorized error is returned from a server, the WWW-Authenticate header should be included in the response, advertising the HTTP authentication methods (or challenges) that might be used to gain access.

By adding this header name to the Access-Control-Expose-Headers header in the server response, it should tell the browser to expose that header to scripts, so that the client can extract the authentication method or challenge and react appropriately.

How Has This Been Tested?

Not yet. Looking for an MCP server that returns WWW-Authenticate header on 401.

Breaking Changes

Nope.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• [] I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

• This fixes WWW-Authenticate headers should be passed through #168