Allow a (hidden undocumented) key to m.login.recaptcha to specify a shared secret to allow bots to bypass the ReCAPTCHA test (SYN-60)
Make sure the config actually /has/ a captcha_bypass_secret set before trying to compare it
Config values are almost never 'None', but they might be empty string. Detect their presence by truth
Send an HMAC(SHA1) protecting the User ID for the ReCAPTCHA bypass, rather than simply the secret itself, so it's useless if that HMAC leaks
Merge branch 'jira/SYN-60' into develop