fix: add consistent CORS security warnings to example servers

[hhhashexe]

Summary

Three example server files lacked the CORS security warnings that are already present in simpleStreamableHttp.ts and authServer.ts. Example code is frequently copy-pasted into production, so insecure defaults without clear warnings pose a real risk.

Closes #1683

Changes

ssePollingExample.ts

• Before: bare app.use(cors()) — no origin restriction, no warning, no exposed headers
• After: explicit origin: '*' with WARNING comments and exposedHeaders matching other examples

honoWebStandardStreamableHttp.ts

• Before: origin: '*' with comment "Enable CORS for all origins" but no WARNING
• After: consistent WARNING comments matching simpleStreamableHttp.ts pattern

elicitationUrlExample.ts

• Before: origin: '*' with credentials: true and no warning. Note: credentials: true with wildcard origin is rejected by browsers per the CORS spec
• After: WARNING comments added, plus a NOTE about the credentials/wildcard incompatibility

Pattern

All three files now use the same comment pattern established in simpleStreamableHttp.ts:

// Enable CORS for browser-based clients (demo only)
// WARNING: This configuration is for demo purposes only. In production, you should restrict this to specific origins and configure CORS yourself.
app.use(
    cors({
        origin: '*' // WARNING: This allows all origins to access the MCP server. In production, you should restrict this to specific origins.
    })
);

Testing

No behavior changes — only comments and the bare cors() → explicit cors({ origin: '*' }) in ssePollingExample.ts (functionally equivalent).

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1d841b3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR