xssProtection property
X-XSS-Protection. Defaults to null, which removes the header
Dart sets. The legacy XSS auditor is gone from current browsers and
had its own bypass-to-injection issues; CSP is the replacement.
Implementation
final String? xssProtection;