upgraded pupil to 1.1.2 and removed required hack

Note validation rule syntax changes; use () instead of : to separate validation
function argument, see pupil readme.

Also couple minor fixes to check for registrations before
registrations.length.