Make xssProtection value configurable with a good default.