Add support for the report= directive in X-Xss-Protection (closes #18).

* https://bugs.webkit.org/show_bug.cgi?id=100892
* https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit/Source/platform/network/HTTPParsers.cpp&l=355