Issue #2378703 by Berdir: Port denial of service fixes from SA-CORE-2014-006 to Drupal 8