json: Enforce token count and size limits more tightly