related to issue #595 a carefully crafted post request could avoid recaptcha, now it's fixed