if your site app is at localhost, and you have a site at localhost/mysite
the jcaptcha image on the form front office authentication will be : localhost/mysite/plugins/core/captcha
and this will be served by the BO... so authentication will not work

(it works fin with a site at root of the FO webapp)