i think this gets rendered in the JSON POST as a key, and then gets rendered in the WebUI to users.  should probably still reference "values" in the name of the attr.  i'm not sure the user will understand what 'safe' means either...  'scrubbed_values'?  dunno.  ideally we'd be able to remap the attribute on the object 'safe_state_attrs' to being rendered as simply 'values' in the JSON output...