Allow PHP serialized values for attributes

This should be with a view to deprecating 'raw' string values. Note that while both are allowed there is the potential for an a value that was never serialized to be later deserialised into arbitrary data (eg if the user inserts `b:1;` or something more imaginative into a text input) so we shouldn't rely on the data type of an attribute. I don't believe this is a security risk, though.