Middleware to set the X-XSS-Protection header