Captcha code not removed after successful verification
We currently remove the captcha session in authFinish step, but this step is not always called in MailReset or Register process, so a valid captcha code can be replayed, as we have the captcha code and the captcha value.
The solution is to delete captcha session as soon as the captcha is validated.