src/main/java/js/http/captcha/Captcha.java
private Map<Integer, Challenge> getChallenges() {
		// here is a circular package dependency that is hard to avoid
		// js.servlet package depends on js.http packages and this js.http.captcha package depends on js.servlet
		// as a consequence js.http.captcha package cannot be used externally without js.servlet
		HttpSession session = context.getInstance(RequestContext.class).getSession(true);

		@SuppressWarnings("unchecked")
		Map<Integer, Challenge> challenges = (Map<Integer, Challenge>) session.getAttribute(CHALENGES_KEY);
		if (challenges == null) {
			challenges = new HashMap<>();
			session.setAttribute(CHALENGES_KEY, challenges);
		}
		return challenges;
	}
private Map<Integer, Challenge> getChallenges() {
		// here is a circular package dependency that is hard to avoid
		// js.servlet package depends on js.http packages and this js.http.captcha package depends on js.servlet
		// as a consequence js.http.captcha package cannot be used externally without js.servlet
		HttpSession session = context.getInstance(RequestContext.class).getSession(true);

		@SuppressWarnings("unchecked")
		Map<Integer, Challenge> challenges = (Map<Integer, Challenge>) session.getAttribute(CHALENGES_KEY);
		if (challenges == null) {
			challenges = new HashMap<>();
			session.setAttribute(CHALENGES_KEY, challenges);
		}
		return challenges;
	}
Get challenge instances storage bound to current HTTP request. Challenges storage is kept on HTTP session. It is legal to
have multiple Simple CAPTCHA instances on a single page but client should use zero based numeric index to identify
instances.
<p>
This method has side effects: it creates HTTP session if is not already created.

@return challenge instances storage.
@throws IllegalStateException if attempt to create new session after response commit.