Config values are almost never 'None', but they might be empty string. Detect their presence by truth
Send an HMAC(SHA1) protecting the User ID for the ReCAPTCHA bypass, rather than simply the secret itself, so it's useless if that HMAC leaks