Limit who can send us AXFR notify queries

Fixes #1937 and #1120
Uh, yes, good point :)