updated config file to include X-XSS-Protection header