simplified code
set header "X-XSS-Protection"