During login I check for either the bot detection or the IP security check, and can open a popup to let the user complete login.
The way it works is that I open up the library, and then run a bit of javascript to redirect to the homepage if there are no security checks. This was the only way I could distinguish between the library loading normally and being locked behind a security check.
I haven't tested the IP check, but I believe it should work. The bot detection will sometimes block my http requests to the library, but when I formally open a browser window, I haven't seen a captcha.
I also rewrote the plugin's HTTP connection to make better use of Cookies. The cookies are created and preserved with each request, which I was hoping would play nicely with their bot detection system. That hasn't seemed to work - but a good benefit of this is when the connection is blocked, you don't have to login again because I've kept the cookies active.
I don't believe I can solve the problem of never losing the connection - IndieGala has bot detection and this plugin is a bot.