SECOAUTH-383: fix iterator logic for multi-valued parameters