add xss-lock