A form, a server-side verify, and a label button. Nothing else.
Waiting for input.
Sign in POSTs the token to /verify, which calls
/v1/siteverify with the sitekey secret held server-side.
Mark as bot POSTs /feedback with label=bot,
which makes the next challenge for this client harder.