Enable x-xss-protection

[XhmikosR]

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

@ScottHelme WDYT about this and #1497?

[ScottHelme]

The XXP header is no longer useful as the XSS Auditor/Filter in mainstream browsers have been deprecated. I wouldn't recommend enabling this header now. For more info: https://scotthelme.co.uk/deprecating-xss-reports/

[XhmikosR]

Thanks for the replies!

I guess I'll drop this then. Can you also chime in in #1017 please?