You don't. But without something like them (or microframeworks + libs) you're going to be rewriting a bunch of stuff yourself. On top of that, security sensitive parts (session management, CSRF protection) that get hand-rolled will need a significant amount of testing.
If you have the time and resources though... go for it!
Edit: But it does seem like there's already some contenders for Go's go-to framework (Like Django/Rails are for their respective language)
My point was that you don't need huge frameworks with high barrier to entry to write web applications -- the things you mentioned can be handled by external modules just as well. Need captcha? Find the best captcha package and use it.
Yes, and tomorrow that captcha package is abandoned, left to rot, etc. Or some other library you used. Especially since most Go packages are one man shows in GitHub (3-4 abandoned MySQL drivers, etc).
I'd rather have a framework with a community that ensures that it is guaranteed to be maintained in the future.
