Add some more missing limit parameters to explode() calls

Add some more missing limit parameters to explode() calls

I benchmarked this again. The runtime of an unlimited explode() can be
quite high. This is not really a DoS attack vector as it would require to
post megabytes worth of input to the code, which will hit many other
limits before. I still consider it good practice to use unlimited explode()
only when it is actually allowed to return an unlimited amount of elements.

Change-Id: I30f8ca5dba7b317bb4a046b9740fd736b4eea291