MAGETWO-36837: Improve admin authentication and remove bypass

Author: Maksym Savich

app/code/Magento/Captcha/Controller/Adminhtml/Refresh/Refresh.php

@@ -27,4 +27,14 @@ public function execute()
         $this->getResponse()->representJson(json_encode(['imgSrc' => $captchaModel->getImgSrc()]));
         $this->_actionFlag->set('', self::FLAG_NO_POST_DISPATCH, true);
     }
+
+    /**
+     * Check if user has permissions to access this controller
+     *
+     * @return bool
+     */
+    protected function _isAllowed()
+    {
+        return true;
+    }
 }