Swapped security header links

X-XSS-Protection and X-Content-Type were mixed up. Switched them to point to the right locations.