Kino 0.1.2

• Drop a connection that has not sent its complete request headers
  within 15 seconds. Closes a slowloris hole: hyper's built-in header-read
  timeout was inert because the server installed no timer, so a slow-header
  client could tie up a connection (and its tokio task) indefinitely.
• Cap concurrent connections (new max_connections directive). Past the cap,
  new connections wait in the kernel backlog instead of piling up until a
  flood exhausts file descriptors or memory. Defaults to most of the process
  open-file limit (ulimit -n), so it scales with the OS limit and only
  engages under a flood.
• Bound the TLS handshake to 10 seconds. A client that completed the TCP
  connect but stalled the handshake could otherwise hold a connection slot
  indefinitely, since the request and header-read deadlines only begin once
  the handshake finishes.
• Cap the request body at 50 MB by default (new max_body_size directive,
  configurable; nil or 0 disables and delegates to a fronting proxy). An app
  that reads rack.input could otherwise be driven to run out of memory by an
  oversized or endless upload. A truthful oversize Content-Length is refused
  with a 413 before the app runs; a chunked or lying client is cut off
  mid-stream once it passes the cap.
• Bound the idle time between request-body frames to 30 seconds. A client that
  began a request then stalled mid-body would otherwise keep a worker blocked
  in rack.input.read indefinitely; now the read raises and the worker
  reclaims its slot. Only a silent client trips it: a steadily-sent body resets
  the deadline each frame, so slow-but-active uploads are unaffected.