set an overall limit on request size (payload.maxBytes)

I realize that the routes are already length limited by Joi validation rules. This just puts a limit (16384) above those to block abusive requests.