Use the canonical header names (X-Xss-Protection, not X-XSS-Protection).