class Rack::Protection::XSSHeader

def call(env)
  status, headers, body = @app.call(env)
  headers['x-xss-protection']       ||= "1; mode=#{options[:xss_mode]}" if html? headers
  headers['x-content-type-options'] ||= 'nosniff'                       if options[:nosniff]
  [status, headers, body]
end