allow string '0' or '1' values for xss protection