PMC-18980 - fix bug; add X-XSS-Protection header