expand readme and update response header for xss