security: limit decompressed gzip output to prevent DoS via decompression bomb

security: limit decompressed gzip output to prevent DoS via decompression bomb #699