Don't set X-XSS-Protection header on old IE by default

Fixes #26.