Fix DELETE handler: validate protocol version before removing session

Use TryGetValue to check version first, then TryRemove to actually
delete. This prevents losing the session if validation fails.

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>

Author: Copilot

src/ModelContextProtocol.AspNetCore/StreamableHttpHandler.cs

@@ -185,15 +185,18 @@ private static async Task HandleResumePostResponseStreamAsync(HttpContext contex
     public async Task HandleDeleteRequestAsync(HttpContext context)
     {
         var sessionId = context.Request.Headers[McpSessionIdHeaderName].ToString();
-        if (sessionManager.TryRemove(sessionId, out var session))
+        if (sessionManager.TryGetValue(sessionId, out var session))
         {
             if (!ValidateProtocolVersionHeader(context, session.Server, out var errorMessage))
             {
                 await WriteJsonRpcErrorAsync(context, errorMessage!, StatusCodes.Status400BadRequest);
                 return;
             }
 
-            await session.DisposeAsync();
+            if (sessionManager.TryRemove(sessionId, out session))
+            {
+                await session.DisposeAsync();
+            }
         }
     }