require captcha only when necessary