What strategies would you implement to mitigate a massive layer 7 DDoS attack without blocking legitimate user traffic?