consolidated captcha/captchasession, internal/private sets where possible, more unit tests