Implementing CAPCHAs into a n-tier arcitechture?

Question

Hi all

I got a 3-tier framework, that looks something like this:

• Web-tier: Presentation and the likes
• Core-tier: Entities, procedures, business logic
• Data-tier: DAL'ing

Now, should my CAPTCHA's go into the web-tier? I'm thinking of 2 levels of validation: Image based CAPTCHA and a SMS-based CAPTCHA. The image based one will obviously be linked quite hard into the markup, soo.. Would it be reasonable to keep the level1 (image CAPTCHA) in the web-layer and the level2 (SMS CAPTCHA) in the core-layer?

Any thoughts?

Thanks :)