Remove unnecessary check for authenticated user

Authentication is forced for /registration/*, so it's safe to assume
that session[:subject] is not nil.
Add client-side validation for secret length