this feature is not security related perse, it's just a way to block
bots and web crawlers. The challenge is occurring only on public pages.

Thanks to Tyson Tan for supplying this great mascot

This includes complying with standards that allow mobile browsers to
create a pseudo-app out of the site, complete with homescreen icon,
splash-screen, and a minimal browser-less UI

Also file permission cleanup