Improve inline comments about `X-XSS-Protection`

Provide more information on how the Cross-Site Scripting (XSS)
filter works by default, and in combination with `X-XSS-Protection`
HTTP header.