do security checks *after* checking captcha