Update security_best_practices.mdx

Author: localden

docs/specification/draft/basic/security_best_practices.mdx

@@ -115,7 +115,7 @@ attack becomes possible:
 MCP proxy servers using static client IDs **MUST** obtain user consent for each dynamically
 registered client before forwarding to third-party authorization servers (which may require additional consent).
 
-### 2.2 Token passthrough
+### 2.2 Token Passthrough
 
 "Token passthrough" is an anti-pattern where an MCP server accepts tokens from an MCP client without validating that the tokens were properly issued _to the MCP server_ and "passing them through" to the downstream API.