right now it's possible to indefinitely submit the registration and password reset forms maybe we should add a captcha or something else?