server: sanity check incoming command size (and payload)