Card #241 - serverside validation of captcha