Resource metadata, PKCE, and token validation done the way the current MCP spec actually requires, not the way a tutorial from last year shows it.