add report=uri to X-XSS-Protection