Security not working

I have the latest Data Bridge installed... using DW CS4. I am trying to create a CSS form for the first time to see how it works. It's a basic contact form that sends an email via the default email script.

The problem is that Captcha, and the other security question are not working. They show up fine and look like they should work, but it doesn't matter what I enter in the fields (deliberately wrong answers) the email still sends and the page directs to the confirmation page. This occurs on both my local server, and my remote server.

I was assuming the CSS forms did all the scripting automatically... but I notice in the Server Behavior tab in Dreamweaver Universal Email is the only item to appear... there is no validation behaviors which is something I would expect to see. Am I missing a step somewhere such as the validation to check captcha?

EDIT TO ADD: Just for the record, the client side validation (jquery) is working fine.

I managed to figure out the problem... although I'm not sure why it would have such a negative effect on the scripts being created.

The problem is in the "Specify the action page" during the form setup. The default is "PHP_SELF" which will not work for me as almost every one of my sites uses clean URL's using Framework. I usually need to change that to REQUEST_URI so the form will submit to itself.

During form setup... if I change PHP_SELF to REQUEST_URI the validation scripts are not applied. I have to create the form with the default PHP_SELF, then manually change all instances of PHP_SELF to REQUEST_URI and the validation will work fine.

NOTE: when using clean URL's...

PHP_SELF points to "index.php" (or whatever file is used as the host file)
REQUEST_URI points to "/en/contact-us/contact" (or however it is setup on a particular site and server)