Only some values can be masked. Currently API defaults :masked to false
and browser defaults :masked to true - resolve this ambiguity by
requiring QA to be explicit about which value it requires for :masked.