Protecting Metadata Servers From Harm Through Application-level I/O Control