Steps to reproduce:
1. start tasklist and login into tasklist
2. create or update a filter
3. add filter criteria (e.g. "candidateGroups" or "Activity Instance Id In")
4. add a value (e.g. "abc,def")
5. save filter
--> The response is a 400 because provided value cannot deserialized into an array
If the provided value for "candindateGroups" or "Activity Instance Id In" is not an expression then the provided value will be transformed into an array, so that the REST Api can deserialize the value into a proper array.