code: function recaptchaVerify(req, res, action = 'form_submit', cb, token = '', threshold = 0.3) {
    const { zlSite } = res.locals;
    if (zlSite.user) {
      // signed in user don't need to verify
      cb();
    }
    else {
      if (!token && 'POST' === req.method) {
        token = req.body.recaptcha;
      }
  
      if (!token) {
        cb('Token is required.');
      }
      else {
        request.post({
          url: 'https://www.google.com/recaptcha/api/siteverify',
          json: true,
          form: {
            secret: req.app.locals.reCAPTCHAsecret,
            response: token,
            remoteip: req.ip
          }
        }, function (error, response, body) {
          if (error) {
            req.app.error(error);
            // no error of user fault so allow action
            cb();
          }
          else if (body && body.success) {
            if (body.hostname !== req.hostname) {
              cb(`site: ${req.hostname} did not match recaptcha from ${body.hostname}`);
            }
            else if (body.score < threshold) cb('score below threshold');
            else if (action !== body.action) {
              cb(`action: ${action} did not match recaptcha action: ${body.action}`);
            }
            else cb();
          }
          else cb('unknown error occurred');
        });
      }
    }
  }
docs: to verify recaptcha