Only generate valid-length codewords

This prevents potential DoS through requesting the server to generate enormous
codewords, first reported here [0].

[0] https://github.com/freedomofpress/securedrop/issues/4#issuecomment-27372878