This tests that the X-XSS-Protection header is not ignored when the report and mode directives are swapped.