password encode, remember login state, validate captcha