Plain's HTTP server now protects itself while receiving request bodies: oversized uploads get a 413 straight from the headers, an upload flood load-sheds with a 503, and slow-drip (R.U.D.Y.) attacks that trickle bytes to pin a connection get a 408. All on by default.