search: add LimitReader around JSON decoding. add some TODOs

Change-Id: I98069ef0aeb8c96cdc997c138222e0344981ead8