[minor] Added x-xss protection headers to all HTTP requests (IE only)