Security not working

I have the latest Data Bridge installed... using DW CS4. I am trying to create a CSS form for the first time to see how it works. It's a basic contact form that sends an email via the default email script.

The problem is that Captcha, and the other security question are not working. They show up fine and look like they should work, but it doesn't matter what I enter in the fields (deliberately wrong answers) the email still sends and the page directs to the confirmation page. This occurs on both my local server, and my remote server.

I was assuming the CSS forms did all the scripting automatically... but I notice in the Server Behavior tab in Dreamweaver Universal Email is the only item to appear... there is no validation behaviors which is something I would expect to see. Am I missing a step somewhere such as the validation to check captcha?

EDIT TO ADD: Just for the record, the client side validation (jquery) is working fine.