Normalize whitelisted HTTP methods

Store whitelisted HTTP methods as tuples; treats a bare string as a single-method tuple for consistency.