delete captcha.py
check user inputs on server
expire cookie when we detect CSRF