fix #19: captcha never removes transient data