Changed X-XSS-Protection to follow standards.
@@ -49,7 +49,7 @@ server {
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY always;
add_header Strict-Transport-Security "max-age=3153600;includeSubDomains";
- add_header X-XSS-Protection "1; mode=block";
+ add_header X-XSS-Protection "0";
location @apiError {
add_header Content-Type application/json always;
