REQUEST_BODY_LENGTH is only available in phase 3, but certain security rules (e.g., request body validation) execute in phase 2. This timing issue makes it impossible to properly use ...