To explain this issue, please read this first:
As I explained in the issue above, when the Session is instantiated before Captcha, the 'captcha_response' value will not be written in the session because Session::write was called first in the queue of register_shutdown_function. Auth will more like cause this issue to arise because it uses the Session, and it's very likely that Auth is called before Captcha.
If in case my suggested fix is rejected (which is very likely), I'm wondering if you can fix this issue by not calling register_shutdown_function but instead, call the Captcha::update_response_session() somewhere else where it doesn't need to be called on shutdown.
I don't know if I considered all the scenarios already, but there should be a solution somewhere.
I have the same issue with module.
The solution I found on Kohana Forum is to place update_response_session() in the Controller and deactivate register_shutdown_function():
public function after()
I will implementing this suggestion in the next commit, thanks!
Shutdown register is not the ideal obviously, but since the event handling functionality was removed from Kohana the options were limited.