Maybe separation between XSS and Script (for 4.0) can be great too
Default XSS == 1 => XSS on for (! superadmin && !ForcedAdmin)
XSS = 0 : Xss all for all

Add script active settings (start in config.php)

Then we can have
XSS true for : (!ForcedAdmin) or (!superadmin) or (All user)
script true for : (same as XSS (default)) or All user (even with XSS enable) or superadmin (even if XSS for superadmin).

This settings can be accessible only via php file.

Maybe separation between XSS and Script (for 4.0) can be great too
Default XSS == 1 => XSS on for (! superadmin && !ForcedAdmin)
XSS = 0 : Xss all for all

Add script active settings (start in config.php)

Then we can have
XSS true for : (!superadmin) or (All user) or (!ForcedAdmin)
script true for : (!superadmin) or (All user) or (!ForcedAdmin)