add a hidden field to user signup to try and prevent bots joining