Cloudflare Turnstile captcha not being utilised by signup

- [ yes ] I confirm this is a bug with Supabase, not with my own application. - [ yes ] I confirm I have searched the [Docs](https://docs.supabase.com), GitHub [Discussions](https://github.com/supabase/supabase/discussions), and [Discord](https://discord.supabase.com). ## Describe the bug - My captcha for turnstile doesn't actually get verified. I have attack protection enabled and have followed the turnstile guide in the docs but users can still signup whether I pass the captcha token to the signup function or not. ## To Reproduce Steps to reproduce the behavior, please provide code snippets or a repository: 1. Create a managed cloudflare turnstile widget that does not use pre-clearance 2. Turn on attack protection on supabase and enter cloudflare turnstile secret key 3. Place @marsidev turnstile component in route, 4. Let the turnstile task be completed on browser 5. In backend do not submit the captcha token from the component. Just submit a random string of characters. Or just leave it empty. So like this for example: ` const { error } = await supabaseClient.auth.signUp({ email: validation.data.email, password: validation.data.password, options: { captchaToken: 'notarealtoken', data: { name: validation.data.firstName.trim() + ' ' + validation.data.lastName.trim(), customerId: customer.id, }, } }); ` ## Expected behavior I should ideally receive an error when signing up that the captcha token was not submitted and the sign up email should not be sent to the email used for signup. ## Screenshots ## System information - OS: macOS - Browser: Chrome - Version of supabase-js: "@supabase/auth-js": "^2.69.1", "@supabase/auth-ui-react": "^0.4.7", "@supabase/auth-ui-shared": "^0.1.8", "@supabase/ssr": "^0.6.1", "@supabase/supabase-js": "^2.49.4", - Version of Node.js: 18.0.0 ## Additional context Add any other context about the problem here.