removed `x-xss` middleware