re-added x-xss-protection header
grouped the headers together
fixed caps

fixed caps