Source:
<code>private EPersonRest createAndReturn(Context context, EPersonRest epersonRest, String token) throws AuthorizeException, SQLException { RegistrationData registrationData = registrationDataService.findByToken(context, token); if (registrationData == null) { throw new DSpaceBadRequestException("The token given as parameter: " + token + " does not exist" + " in the database"); } if (es.findByEmail(context, registrationData.getEmail()) != null) { throw new DSpaceBadRequestException("The token given already contains an email address that resolves" + "to an eperson"); } String emailFromJson = epersonRest.getEmail(); if (StringUtils.isNotBlank(emailFromJson)) { if (!StringUtils.equalsIgnoreCase(registrationData.getEmail(), emailFromJson)) { throw new DSpaceBadRequestException("The email resulting from the token does not match the email given" + " in the json body. Email from token: " + registrationData.getEmail() + " email from the json body: " + emailFromJson); } } if (epersonRest.isSelfRegistered() != null && !epersonRest.isSelfRegistered()) { throw new DSpaceBadRequestException("The self registered property cannot be set to false using this method" + " with a token"); } checkRequiredProperties(epersonRest); if (!AuthorizeUtil.authorizeNewAccountRegistration(context, requestService .getCurrentRequest().getHttpServletRequest())) { throw new DSpaceBadRequestException( <START> "Registration is disabled, you are not authorized to create a new Authorization"); <END> } context.turnOffAuthorisationSystem(); EPerson ePerson = createEPersonFromRestObject(context, epersonRest); context.restoreAuthSystemState(); accountService.deleteToken(context, token); return converter.toRest(ePerson, utils.obtainProjection()); }</code><technical_language>Again, this moved top of method. need do checks if registration is disabled altogether</technical_language>

Target:
private EPersonRest createAndReturn(Context context, EPersonRest epersonRest, String token) throws AuthorizeException, SQLException { if (!AuthorizeUtil.authorizeNewAccountRegistration(context, requestService .getCurrentRequest().getHttpServletRequest())) { throw new DSpaceBadRequestException( "Registration is disabled, you are not authorized to create a new Authorization"); } RegistrationData registrationData = registrationDataService.findByToken(context, token); if (registrationData == null) { throw new DSpaceBadRequestException("The token given as parameter: " + token + " does not exist" + " in the database"); } if (es.findByEmail(context, registrationData.getEmail()) != null) { throw new DSpaceBadRequestException("The token given already contains an email address that resolves" + "to an eperson"); } String emailFromJson = epersonRest.getEmail(); if (StringUtils.isNotBlank(emailFromJson)) { if (!StringUtils.equalsIgnoreCase(registrationData.getEmail(), emailFromJson)) { throw new DSpaceBadRequestException("The email resulting from the token does not match the email given" + " in the json body. Email from token: " + registrationData.getEmail() + " email from the json body: " + emailFromJson); } } if (epersonRest.isSelfRegistered() != null && !epersonRest.isSelfRegistered()) { throw new DSpaceBadRequestException("The self registered property cannot be set to false using this method" + " with a token"); } checkRequiredProperties(epersonRest); context.turnOffAuthorisationSystem(); EPerson ePerson = createEPersonFromRestObject(context, epersonRest); context.restoreAuthSystemState(); accountService.deleteToken(context, token); if (context.getCurrentUser() == null) { context.setCurrentUser(ePerson); } return converter.toRest(ePerson, utils.obtainProjection()); }