X-XSS-Protection headers. Protection or vulnerability?