Fix: an MCP client drops the Authorization header across a 308 cross-origin redirect and gets a 401
Your MCP URL 307/308-redirects to another host, the client follows it, the Authorization header is stripped, and the target answers 401. Register the final URL.