title: X-FRAME-OPTIONS is shown twice and X-XSS-PROTECTION is shown wrong
body: <p>I am trying to fix my headers. I see two errors when checking the network requests as I visit my page:</p>
  
  <p>1) <code>X-FRAME-OPTIONS: SAMEORIGIN</code> is shown twice:</p>
  
  <pre class="lang-none prettyprint-override"><code>Cache-Control:no-cache
  Connection:Keep-Alive
  Content-Encoding:gzip
  Content-Type:text/html; charset=UTF-8
  Date:Wed, 04 Oct 2017 12:58:30 GMT
  Keep-Alive:timeout=3, max=1000
  Server:Apache
  Set-Cookie:laravel_session=eifQ%3D%3D; expires=Wed, 04-Oct-2017 14:58:30 GMT; Max-Age=7200; path=/; secure; httponly
  Set-Cookie:XSRF-TOKEN=n0%3D; expires=Wed, 04-Oct-2017 14:58:30 GMT; Max-Age=7200; path=/
  Transfer-Encoding:chunked
  X-CDN:Incapsula
  X-Frame-Options:SAMEORIGIN * &lt;-------------- HERE
  X-Frame-Options:SAMEORIGIN * &lt;-------------- HERE
  X-Iinfo:7-6626704-6651371 NNNN CT(0 0 0) RT(1507121414380 495318) q(0 1 1 -1) r(2 2) U16
  X-XSS-Protection:%E2%80%9C1;mode=block%E2%80%9D &lt;-------- Strange Encoding here...
  </code></pre>
  
  <p>2) I can see the following error on the console for <code>X-XSS-PROTECTION</code>:</p>
  
  <blockquote>
    <p>Error parsing header X-XSS-Protection: â1;mode=blockâ: expected 0 or 1 at character position 0. The default protections will be applied.</p>
  </blockquote>
  
  <p>I am using Laravel 5.0. The <code>FrameGuard.php</code> middleware is not active by default since Laravel 4.2, but you have the option to enable it if needed. When it's disabled, I see the above errors and I really can't understand why, so my first though was to overwrite those headers by actually using that middleware.</p>
  
  <p>When I add the <code>Illuminate\Http\Middleware\FrameGuard.php</code> middleware, which contains the below code, nothing seems to change:</p>
  
  <pre><code>public function handle($request, Closure $next)
  {
      $response = $next($request);
  
      $response-&gt;headers-&gt;set('X-XSS-Protection', '1; mode=block');
      $response-&gt;headers-&gt;set('Content-Type','text/html; charset=UTF-8');
      $response-&gt;headers-&gt;set('X-Frame-Options', 'SAMEORIGIN', true);
  
      return $response;
  }
  </code></pre>
  
  <p>I also use Socialite which provides Facebook authentication. Is there a chance that it modifies any headers?</p>