add x-xss-protection too