Fixed issue: added a hint next to the XSS filter setting to underline that it is always disabled for the superadministrator.