This feels more like it should be configured at an app level, to avoid a potential DoS by an attacker POSTing large bits of content at us?

I suggest we set the [MAX_CONTENT_LENGTH configuration](http://flask.pocoo.org/docs/config/) to an appropriate value.