Agg captcha

Fixes for #1214 and #1216.

Applied only to gogoduck at the mean time.

Expected behaviour:
 * For clients in our subnet - never display a captcha (configurable in `Config.groovy`)
 * Show captcha for all other users
 * As long as users maintain the same session, do not display a new captcha the next time

Does not include yet IP based ACL and counting how many times every IP address sent a request in the last X minutes.