Reject non-string Web Form Request keys

Rejects list and tuple keys before they're used as ORM filters, preventing filter mismatches.