Ok. The root problem is that our server config is not well documented yet, so I apologize for that. We currently require reCAPTCHA for 2 operations: (1) password reset, and (2) new user registration. In your server config file, there needs to be 2 entries, "recaptchaSiteKey" and "recaptchaSecretKey". You can sign up for recaptcha for free. Alternatively, we could add a setting to disable recaptcha, because it might be overkill in some settings.