add note about x-xss-protection header, closes #1770

This more clearly documents the potential for the security vulnerability caused by X-Xss-Protection being set to '1; mode=block'