See also (AFAIK most of these support JSless challenges out of the box): haproxy-protection, go-away, anticrawl