Fix typo in x-xss-protection header

Noticed this one while checking out ProPublica's live SD instance.