Well, `X-Content-Security-Policy` was used during experimental period: so can cover modern IEs and older browsers with no cost. As for `X-XSS-Protection` you can say, that it's a part of `CSP 1.1` spec which by the way covers some old browsers for today. In anyway, ignoring IE is hard since we're doing Windows releases and it's still on the market (: