return data, but unserialized
serialize value into a string. If af is true, allow functions. This breaks unserialization.