Add project-wide xss header protection.