That is fine for a next step. 

As this library could be used a line of defence, I am wondering if we need to be extra safe. That is, keep these as implemented for a fail-fast, but also wrap this request body in a limiting stream anyway in case the client is nefarious.