BZ-1155269, BZ-1155270: replacing XSS servlet filter by http header