I still wasn't able to solve this problem.

will do, ty!

Thx for the replay, 
1. the problem with checking the header is that it can be toyed with, if someone changes header to say 1kb and sends 4mbs i will check header and let it pass...

I will check about 2 and 3, thx!

EDIT: checked about 2 - something like size property doesn't exist, the maximum you can do with a request is iterate through all the data inside and get its total *length of characters* which is still far from the request size in mbs