Reject events which have too many auth_events or prev_events

... this should protect us from being dossed by people making silly events
(deliberately or otherwise)