Limit the maximum number of Model errors to a reasonable value.

Fixes #490
shouldn't ActionContext constructor just figure this out?