Captcha security issue

Explain: user can only once load captcha image to session data and
later, without reloading page submit any actions without real
confirmation. Fixed.