Adding the X-Xss-Protection header