make http_limit opt-in rather than out