Updated notes on X-XSS-Protection

Not just for IE