So the proposed mitigations (block multipart forms, disable upload progress) are actually helpful (if not necessarily sufficient).