Only attempt to unserialize the allowed types against a user group if it...

... is a string. This prevents an issue when using the API call shoppingCartPaymentList