Whether CloudFront includes the mode=block directive in the X-XSS-Protection header.
mode=block
X-XSS-Protection