nginx config: make sure xss-protection header is sent