Remove header x-xss-protection

[mirek-vl]

x-xss-protection should no longer be used - see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection
Please consider removing the header