[auth] add captcha to prevent brute force attack

Note: this requires [django-simple-captcha](https://django-simple-captcha.readthedocs.org/en/latest/) to be installed in your server.