code: @Nonnull
    public final UnifiedResponse setEnableXSSFilter (final boolean bEnable)
    {
      if (bEnable)
        setCustomResponseHeader (CHttpHeader.X_XSS_PROTECTION, "1; mode=block");
      else
        removeCustomResponseHeaders (CHttpHeader.X_XSS_PROTECTION);
      return this;
    }
docs: This header enables the Cross-site scripting (XSS) filter built into most
  recent web browsers. It's usually enabled by default anyway, so the role of
  this header is to re-enable the filter for this particular website if it
  was disabled by the user. This header is supported in IE 8+, and in Chrome
  (not sure which versions). The anti-XSS filter was added in Chrome 4. Its
  unknown if that version honored this header.
  
  @param bEnable
  <code>true</code> to enable the header, <code>false</code> to
  disable it.
  @return this
  @since 6.0.5