docs: clarify CORS comment and drop stale README bullets

streamable_http_app() enforces localhost-only Origin by default, so the
'Allow all origins' CORS comment was misleading — preflight would
succeed but the actual POST would return 403 for non-localhost origins.

Also removed README bullets that described the manual lifespan/task-group
wiring that no longer exists in these examples.

Author: maxisbey

examples/servers/simple-streamablehttp-stateless/README.md

@@ -7,7 +7,6 @@ A stateless MCP server example demonstrating the StreamableHttp transport withou
 - Uses the StreamableHTTP transport in stateless mode (mcp_session_id=None)
 - Each request creates a new ephemeral connection
 - No session state maintained between requests
-- Task lifecycle scoped to individual requests
 - Suitable for deployment in multi-node environments
 
 ## Usage

examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py

@@ -108,7 +108,7 @@ def main(
     # for browser-based clients (ensures 500 errors get proper CORS headers)
     starlette_app = CORSMiddleware(
         starlette_app,
-        allow_origins=["*"],  # Allow all origins - adjust as needed for production
+        allow_origins=["*"],  # Note: streamable_http_app() enforces localhost-only Origin by default
         allow_methods=["GET", "POST", "DELETE"],  # MCP streamable HTTP methods
         expose_headers=["Mcp-Session-Id"],
     )

examples/servers/simple-streamablehttp/README.md

@@ -6,9 +6,7 @@ A simple MCP server example demonstrating the StreamableHttp transport, which en
 
 - Uses the StreamableHTTP transport for server-client communication
 - Supports REST API operations (POST, GET, DELETE) for `/mcp` endpoint
-- Task management with anyio task groups
 - Ability to send multiple notifications over time to the client
-- Proper resource cleanup and lifespan management
 - Resumability support via InMemoryEventStore
 
 ## Usage

examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py

@@ -132,7 +132,7 @@ def main(
     # for browser-based clients (ensures 500 errors get proper CORS headers)
     starlette_app = CORSMiddleware(
         starlette_app,
-        allow_origins=["*"],  # Allow all origins - adjust as needed for production
+        allow_origins=["*"],  # Note: streamable_http_app() enforces localhost-only Origin by default
         allow_methods=["GET", "POST", "DELETE"],  # MCP streamable HTTP methods
         expose_headers=["Mcp-Session-Id"],
     )