this feature is not security related perse, it's just a way to block
bots and web crawlers. The challenge is occurring only on public pages.

sections/enable/index.php

@@ -1,4 +1,5 @@
 <?
+BIC::challenge();
 
 if (isset($LoggedUser['ID']) || !isset($_GET['token']) || !FEATURE_EMAIL_REENABLE) {
     header("Location: index.php");