>And how do you size the arena?

Should you allow an http-server to allocate unbounded request sizes? Seems like it would lead to an easy denial of service.