2co.js' requestToken method aggressively parses it's params. If the client passes credit card or cvv number as type Number, the library will fail:
a.cvv.replace is not a function
2co.js should check if params are of type Number before parsing, then validate.