Limit HTTP headers to 16384 bytes by default

-- other HTTP servers generally restrict HTTP headers to 4K-16K in total size
-- error out if HTTP headers exceed 16384 bytes
-- can help prevent DoS