Let MCP clients through block_endpoints

With block_endpoints on, MCP clients and the OAuth discovery and registration paths are let through, so MCP clients can connect.