fix QoDs for http, extend warmup time

QoD fixes
1) if we have more than 2000 hits for a token, abort
2) explicitly disallow http queries which for now are a QoD