X_XSS code in secureheaders