Fixed #31 test and fixed #32 header name bug for X-XSS-Protection.

In this commit, we have added a functional test for
XXSSProtectionPlugin. Furthermore, like #27, we have to read the
lower-case header name for X-XSS-Protection.

We should actually address this issue either with curly.py or
individually with each plugin. See issue #33.