more DoS prevention: add packet_limit option to apply a hard limit to downstream...