Limit DecodePostForm

The request.DecodePostForm() helper now uses http.MaxBytesReader to limit form size to 1MB, in line with the request.DecodeJSON() helper.