POST /key needs some kinds of limits

[cyphar]

As discussed in tutor training, we need to add limits so people don't end up posting gigabytes of payload and causing issues for other students. Ideally we'd have a user API with limits for each user, but that would over-complicate something that is meant to be a dead-simple API...