Setting it in a string separated by commas is error-prone. Just accept an array of methods, and in the listener do an implode(',', $allowedMethods).