title: Are both csrf tokens and captcha needed?
body: <p>Can someone confirm this: do I need to provide both a CSRF token and a Captcha in a submission form, or do the two more or less serve the same function (one can be used instead of the other)?</p>