added default limit to 10mb, and allowed config on a per route basis

fixes issue #624