Update README.md: x-xss-protection on all UAs