moved storing TextCaptcha in user object to HttpSession, now captcha
works and is safer against attack