Add a limit to the size of 'old_client_states' fetched from the db.

This shouldn't affect good clients, but may prevent badly-behaved
clients from swamping us with nonsense records to be held in memory.