Require captcha for xml export, since it's resource heavy.
Let bots through.