Require a captcha for visitor submissions and for login.

Without the form field, the check was skipped. A solved captcha lasts
30 minutes in the session.

publish/write.inc.php

@@ -103,8 +103,9 @@ if (isset($file_src) || isset($img)) {
 </div>
 
 <?php
-  if (!$is_admin && (($action == "") || isset($validate['captcha']))) {
-    echo '<div class="g-recaptcha" data-sitekey="'.htmlspecialchars(config('RECAPTCHA_SITE_KEY')).'"></div>';
+  // Visitors solve the captcha once; the session remembers it until the story is saved
+  if (!$is_admin && !captcha_passed()) {
+    echo captcha_widget();
   }
 
   if ($is_admin) {