According to the issue desc, we should be preferring facts.name if it's available.  facts.values is user-controlled, whereas we can be sure that the value in facts.name is trusted.