DoS via markdown API from unauthenticated user