Limit the request body size by config setting

[craigminihan]

Prevent DOS via massive request bodies (or at least content length specifiers). ideally allow for a config setting to control the max inbound size.