Limit who can send us AXFR notify queries

Fixes #1937 and #1120
`.match` can deal with the empty case fine, and the arg() lookup is expensive.