Only unmarshal data that we marshaled

This commit removes the ability to inject fake marshaled objects into
string values.