Add a way to limit deserialized string lengths

and use it for most strings being serialized.