Search: limit number of results (prevent DoS)

This should prevent a DoS attack where a script requests GET /api/v2/search?q=AAAAAA&limit=99999999999 repeatedly

This only partly solves the problem. Even min(limit, 1) is too much, if the search term is unique and doesn't exist in the database.

merged

mentioned in commit 7c1d8045