Use captchas only once and regenerate the list if empty

This makes sure a captcha cannot be reused by a witty client. It may
still be possible to guess the existing list.