Client continuously sends requests after server restart, causing 401 Unauthorized

Describe the bug
When running mcp-server and auth-server with npm run dev:with-separate-auth, the connection works successfully at first. However, after the server restarts, the client (Cursor) keeps sending repeated requests to the mcp-server and receives 401 Unauthorized responses. Once the server replies with Too Many Requests, the requests stop.

To Reproduce
Steps to reproduce the behavior:

Start mcp-server and auth-server with npm run dev:with-separate-auth.

Confirm that the connection is established successfully.

Restart the server.

Observe that the client (Cursor) keeps sending requests to the mcp-server, resulting in 401 Unauthorized responses until the server eventually responds with Too Many Requests.

Expected behavior
After the server restarts, the client should refresh/re-establish a valid session/token instead of continuously sending unauthorized requests.

Logs
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/.well-known/oauth-protected-resource/mcp","headers":{"user-agent":"node","mcp-protocol-version":"2025-06-18","accept":"/"},"userAgent":"node","path":"/.well-known/oauth-protected-resource/mcp","msg":"Request received","time":"2025-09-30T07:49:01.729Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/.well-known/oauth-protected-resource/mcp","statusCode":404,"duration":"1ms","userAgent":"node","path":"/.well-known/oauth-protected-resource/mcp","msg":"Request completed","time":"2025-09-30T07:49:01.730Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/.well-known/oauth-protected-resource","headers":{"user-agent":"node","mcp-protocol-version":"2025-06-18","accept":"/"},"userAgent":"node","path":"/.well-known/oauth-protected-resource","msg":"Request received","time":"2025-09-30T07:49:01.731Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/","statusCode":200,"duration":"0ms","userAgent":"node","path":"/.well-known/oauth-protected-resource","msg":"Request completed","time":"2025-09-30T07:49:01.731Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/mcp","headers":{"user-agent":"Cursor/1.7.17 (darwin arm64)","mcp-protocol-version":"2025-06-18","mcp-session-id":"bb9e7729-527a-41bf-8176-47079a0364a6","accept":"text/event-stream"},"userAgent":"Cursor/1.7.17 (darwin arm64)","path":"/mcp","msg":"Request received","time":"2025-09-30T07:49:01.743Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":20,"token":"b99bfaf8...","cacheDuration":"60s","userAgent":"Cursor/1.7.17 (darwin arm64)","method":"GET","path":"/mcp","msg":"Token validation cached","time":"2025-09-30T07:49:01.747Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":20,"method":"GET","sessionId":"bb9e7729-527a-41bf-8176-47079a0364a6","userId":"47548bff-02ad-44ec-a6fc-25fc7bb925a7","hasAuth":true,"authExtra":{"userId":"47548bff-02ad-44ec-a6fc-25fc7bb925a7","iss":"http://localhost:3001","aud":"http://localhost:3232"},"userAgent":"Cursor/1.7.17 (darwin arm64)","path":"/mcp","msg":"SHTTP request received","time":"2025-09-30T07:49:01.749Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":20,"sessionId":"bb9e7729-527a-41bf-8176-47079a0364a6","userAgent":"Cursor/1.7.17 (darwin arm64)","method":"GET","path":"/mcp","msg":"Session not live","time":"2025-09-30T07:49:01.749Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":40,"sessionId":"bb9e7729-527a-41bf-8176-47079a0364a6","userId":"47548bff-02ad-44ec-a6fc-25fc7bb925a7","requestMethod":"GET","userAgent":"Cursor/1.7.17 (darwin arm64)","method":"GET","path":"/mcp","msg":"Session ownership mismatch","time":"2025-09-30T07:49:01.749Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/mcp","statusCode":401,"duration":"7ms","userAgent":"Cursor/1.7.17 (darwin arm64)","path":"/mcp","msg":"Request completed","time":"2025-09-30T07:49:01.750Z","v":0}

Additional context

This issue only happens after a server restart. The initial connection works without issues.

The client is Cursor, which connects to the mcp-server.

Start by reproducing the issue with npm run dev:with-separate-auth, then inspect the MCP request, authentication, and session handling represented in the logs. Verify behavior across a server restart, including the invalid session and repeated 401 responses; done means the client refreshes or re-establishes a valid session instead of retrying until rate limited.