added common non-standard X-XSS-Protection header

ref: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers