Wt

Currently, when the number of plain HTML and Ajax sessions combined is over the limit of 20 session in total, DoS protection will be checked.
It will be triggered if the plain HTMl sessions exceeds to maximum allowed ratio.

The limit of 20 is hardcoded, and a very small limit at that. We should:

• extract the value
• make the value configurable
• make de default value larger (e.g. 100)
• extend the documentation, so that the value itself, and how sessions are counted are more clear. Especially the interaction with bots and the the bootstrap timeout should be made clear.