Almost every person I've talked to has had to get another CAPTCHA because it expired before they finished filling in the sign-up form. Extending the expiry time to five minutes should be reasonable.
