Instead, just check the recaptcha response parameter directly, as
we will need to do when using the reCAPTCHA Javascript API.

Also adds some test coverage for spammable_actions