Allow only a whitelist of settings attrs to be overridden

Makes it more secure, since the enclosed converse object as access to
privileged data, we don't want people to inject code that could expose that.