Fix typo in x-xss-protection header