DEFAULTS

HTTP queries come from untrusted callers: a bounded default; in-process queries are trusted code.