The "auto-captcha" setting:

If enabled, the /login page provides a button that will automatically fill in the captcha password. This makes things easier for human users, at the expense of also making logins easier for malicious robots.