revert documentation changes

Author: RossTarrant

docs/streamable-http.md

@@ -8,7 +8,6 @@ The Streamable HTTP mode enables the GitHub MCP Server to run as an HTTP service
 - **OAuth Metadata Endpoints** — Standard `.well-known/oauth-protected-resource` discovery for OAuth clients
 - **Scope Challenge Support** — Automatic scope validation with proper HTTP 403 responses and `WWW-Authenticate` headers
 - **Scope Filtering** — Restrict available tools based on authenticated credentials and permissions
-- **CORS & Browser Client Support** — Built-in CORS middleware and configurable cross-origin protection for browser-based MCP clients
 - **Custom Base Paths** — Support for reverse proxy deployments with customizable base URLs
 
 ## Running the Server
@@ -60,36 +59,6 @@ The OAuth protected resource metadata's `resource` attribute will be populated w
 
 This allows OAuth clients to discover authentication requirements and endpoint information automatically.
 
-## Cross-Origin & Browser Client Support
-
-The HTTP server includes built-in CORS middleware and cross-origin request handling to support browser-based MCP clients (e.g., web apps, MCP Inspector).
-
-### Default Behavior
-
-`RunHTTPServer` enables browser cross-origin support out of the box by wiring in two things:
-
-1. **CORS middleware** (`SetCorsHeaders`) — responds to preflight `OPTIONS` requests and sets `Access-Control-*` headers on all MCP endpoint responses
-2. **Cross-origin protection bypass** — bypasses the SDK's `Sec-Fetch-Site` rejection so cross-origin POST requests are allowed
-
-This is safe because the server authenticates exclusively via bearer tokens (`Authorization` header), which are not ambient credentials — a malicious cross-origin page cannot cause the browser to attach them automatically. Standard CSRF protection is therefore not required.
-
-> **Note:** CORS headers on MCP endpoints are provided by `SetCorsHeaders` middleware. OAuth metadata discovery routes (e.g., `/.well-known/oauth-protected-resource`) handle CORS independently.
-
-### Library / Custom Integrations
-
-If you embed the server as a library (using `ServerConfig` directly rather than `RunHTTPServer`), neither the CORS middleware nor the cross-origin bypass is applied automatically. To support browser clients, you must:
-
-1. Add `middleware.SetCorsHeaders` to your router
-2. Set the `CrossOriginProtection` field on `ServerConfig` with an appropriate bypass pattern
-
-The `CrossOriginProtection` options are:
-
-- **`nil`** — `RunHTTPServer` auto-bypasses (allows all origins); library consumers get the SDK default (reject cross-origin POSTs)
-- **Explicit bypass** — Create a `CrossOriginProtection` with `AddInsecureBypassPattern("/")` to allow all cross-origin requests
-- **SDK default** — Use `http.NewCrossOriginProtection()` without any bypass patterns to reject cross-origin POSTs
-
-The SDK default is appropriate when browser cross-origin clients are not required (e.g., native CLI clients only, or same-origin browser deployments where the client and server share the same origin).
-
 ## Client Configuration
 
 ### Using OAuth Authentication