This section is at https://rollingedition.com/model-context-protocol-in-practice/mcp-security#no-token-passthrough.