restrict packet size to 4K in server

- Sending a negative length no longer crashes the server
- Sending very large lengths can't force us to buffer stupid amounts of data

The offending client just gets kicked if they do this.
Merge pull request #3535 from chrisforbes/lobby-robustness

restrict packet size to 4K in server