mozilla/fxa-auth-server — pull request #777 by jrgm (2014-08-05 21:01:51+00:00)
Title: limit payload.maxBytes to 16384

16384 bytes is arbitary but seems about right. In stage traffic logs, the maximum size I saw (which for nginx includes headers) was less than 1200 bytes.