Tell clients that they are allowed to use Mcp-Session-Id header

[Nyholm]

Add an extra cors header. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Expose-Headers

Motivation and Context

I had issues running HTTP server with modelcontextprotocol/inspector. It would never connect.

After some debugging I found that after initialization the client sent an "initialized" notification without session id.

How Has This Been Tested?

Yes, With modelcontextprotocol/inspector

Breaking Changes

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[Nyholm]

Thank you

[chr-hertel]

Thank you @Nyholm 🙌