Bug 944824 - Add X-XSS-Protection and X-Content-Type-Options headers