2043283: X-XSS-Protection is disabled by default