On old versions of Internet Explorer, X-XSS-Protection: 1; mode=block creates a vulnerability (see here and here), and so the header is should be set to 0 to mitigate that vulnerability.