If I want to do a secure firebase login/signup with google recaptcha, do I have to do it on the server side? Verifying the captcha and providing auth in the frontend with a boolean state alone feels a bit off.