I followed the steps provided in this post  in an attempt to overlay the /libs/cq/xssprotection/config.xml file. My changes are not being recognized per this warning in the logs: "The span tag contained an attribute that we could not process. The endnote attribute has been filtered out, but the tag is still in place. The value of the attribute was..."
The change to the config.xml file is <attribute name="endnote" description="endnote attribute provides the actual citation text"> <regexp-list> <regexp name="anything"/> </regexp-list> </attribute>