ban after 5 captacha failures
use xor