Registration captcha makes registration difficult for users not used to filling forms and required data. With our default authentication timeout of 120s, it is difficult to understand the form and fill it if CAPTCHA is enabled, as after 120s CAPTCH is invalidated (it is kept in XMPPResourceConnection instance that is destroyed after disconnection).

Additionally, some often used clients (ie. Gajim, Kaidan) are fetching form and disconnecting from the server and sending form on a subsequent connection to the server making impossible for those clients to register to our service. After a short research it looks like it is a common practice.

Solution both issues is to store CAPTCHA data in HMAC signed hidden field in form allowing it to be used even on subsequent connection to the servers for about 5 minutes since retrieval of the form.