X-XSS-Protection is a non-standard but widely used header that instructs browsers to enable or disable their builtin protection against reflected XSS attacks.
Most websites I visit send
X-XSS-Protection:1; mode=block or no header at all, which, I think, falls back on the browser's default. On the other hand, Facebook sends
X-XSS-Protection: 0, something I've only seen in websites demonstrating the XSS attack.
What could be the reason for this?