Yep.  Generally I work on the principle that if a class can do some work without the dependencies, they should be injected via get / set, but if they are integral to its operation then constructor injection is better.  Sometimes I forget the principle though as I think I'd probably agree that the PayumController can't do much without the registry!  Happy to refactor to controller injection.

Do you think the same is true of the HttpRequestVerifier - I'm guessing yes...?