You should be using multi-part/chunked encoding for large file sizes as it helps prevents DDOS attacks.

And having an insecure default is a huge difference from 100% of requests are allowed.