do security checks *after* checking captcha
Merge pull request #152 from bui/captcha-validate

do security checks *after* checking captcha