Enforce request body limits. Closes #299.