Added image/jpeg content-type header to /captcha.jpg. Made unsigned digests urlsafe (as they were intended to be).