explicitly made registration endpoint a "protected resource", closes #81