add note about x-xss-protection header, closes #1770
Merge pull request #1786 from spumko/docfix

add note about x-xss-protection header, closes #1770