pub const PATH: &str = "/mcp";
Where the MCP server lives; the Origin check exempts exactly this path.
Origin