5.3.26

Fixes re-authentication for clients configured with the /wp-json address: the discovery document and challenge header now describe the address the client actually called, instead of naming the new /mcp address everywhere.