move some captcha checks into PHP