v1.33.1

A small fix to the browser widget's error reporting. No server change, no API change.

Fixed

errorCallback was handed undefined on the most common failure.

All three servers refuse a verification with success:false and no message field. The widget passed that absent field straight through to the integrator's errorCallback, so anyone rendering the argument got nothing:

FCaptcha.render('captcha', {
  siteKey: '...',
  errorCallback: function (error) {
    showError(error);   // <- undefined on a refused verification
  }
});

This project's own demo page did exactly that, and showed an empty box under "Verification failed" — which reads as a broken widget rather than as the widget doing its job. Withholding the token is the correct outcome on a failed verification, and the callback should be able to say so.

The widget's own label already fell back to the localized "verification failed" string; only the callback missed out. The message is now resolved once, so the label and the callback receive the same value, correctly localized to the widget's language. When a server does supply text, it still passes through verbatim.

No change is required in your integration — an errorCallback that previously received undefined now receives a displayable string.

The Node library warned twice about dev mode. FCAPTCHA_INSECURE_DEV_MODE printed its warning once for the challenge store and once for the scoring engine, since each resolves the secret. It now warns once per process. Once is a warning; twice teaches people to scroll past it.