only read 256 kB

[chadwhitacre]

The filesize validation is soft and not hard: it's easily gotten around by sending a false Content-Length. We should only read at most the first 256 kB of the upload, and 413 if we don't find EOF before then. This might require some Aspen request.body modifications.

[chadwhitacre]

Doesn't look like we can't configure this at Heroku or in gunicorn. We either need to migrate to Digital Ocean so we can put nginx in front, or implement in gip.rocks itself using Aspen hooks. The latter is probably enough for now.