Limit the length of many form fields

[alexander-bauer]

API endpoints such as /api/message have a high potential for abuse, despite protections such as CAPTCHA and IP authentication. Thus, the number of characters they accept should be limited, so as to prevent DOSing or spam.