Should we blindly trust that the Content-Length has been correctly set in the request. Should we wrap the stream in a limiting stream anyway?