lib/url: fetch max 1MB to avoid DoS