Turn streaming request parsing back on for 1.3.  Fix CSRF which was breaking it.  It's really not at all obvious if we need to byte limit the stream that we hand over or not.