add X-XSS-Protection header in http response