If memory serves cleanse/uncleanse was for protecting against XSS in an app's configs that were sent to client. IMO, it shouldn't apply to things the developer has defined. But perhaps there was a concern developers would put user input in the config object destined for the client at runtime?