chg: [response header] Added `X-XSS-Protection` header

- As reported by an external pentest company on behalf of the Centre for Cyber security Belgium (CCB)

app/Controller/AppController.php

@@ -136,6 +136,7 @@ class AppController extends Controller
                 $this->_stop();
             }
         }
+        $this->response->header('X-XSS-Protection', '1; mode=block');
 
         if (!empty($this->params['named']['sql'])) {
             $this->sql_dump = intval($this->params['named']['sql']);