added CAPTCHA, and changed /generate/ to a POST request