To not deserialize over-sized requests with content body, we also need transport-specific size restrictions. They are come before input validation, and are also configurable. Change-Id: I06434431b3df9250c05472b4d91a53dfedb682d2