added DisableXSSFilter middleware for output additional X-XSS-Protection: 0 response header to make easier for XSS attacking