added default limit to 10mb, and allowed config on a per route basis, also CORS

fixes issue #624