The spec says we should return `M_FORBIDDEN` when someone tries to register and registration is disabled.
