can get captcha from client via /auth now. fighting with cookies