change all XSS protection values to integer, since string causes an exception
Followup to #41, allow those values anyways