added X-XSS-Protection to template.php