Fixing posts/users relation.

Adding header to skip X-XSS-Protection for now.