Shipping an OAuth-protected remote MCP server: the spec and 3 security bugs skilldb.dev 1 point by dev_chad 3 hours ago