Technically, the reason it was once per use per session was not because of the Rails upgrade, but because once the A/Bingo human check missing the CSRF token re

Technically, the reason it was once per use per session was not because of the Rails upgrade, but because once the A/Bingo human check missing the CSRF token resets the session, the visitor is marked human and not checked again.