Limit who can send us AXFR notify queries

Fixes #1937 and #1120