Bugfix and reduce strictness of default React configuration

This release fixes a bug where the Values fields/options was not expanded, leading to a literal $v in the generated policy. In addition, the default React security options have been made more liberal for ease of use.