Would it be reasonable to request an authentication image for captcha-less ?