diff --git a/www/common/outer/store-rpc.js b/www/common/outer/store-rpc.js
index 80d14c1c4..0ad6e3c40 100644
--- a/www/common/outer/store-rpc.js
+++ b/www/common/outer/store-rpc.js
@@ -24,7 +24,7 @@ define([
             UPLOAD_COMPLETE: Store.uploadComplete,
             UPLOAD_STATUS: Store.uploadStatus,
             UPLOAD_CANCEL: Store.uploadCancel,
-            WRITE_LOGIN_BLOCK: Store.writeLoginBlock, // XXX restricted-registration
+            WRITE_LOGIN_BLOCK: Store.writeLoginBlock,
             REMOVE_LOGIN_BLOCK: Store.removeLoginBlock,
             PIN_PADS: Store.pinPads,
             UNPIN_PADS: Store.unpinPads,
diff --git a/www/common/pinpad.js b/www/common/pinpad.js
index 6bd4e658e..e1dad6488 100644
--- a/www/common/pinpad.js
+++ b/www/common/pinpad.js
@@ -220,17 +220,21 @@ var factory = function (Util, Rpc) {
                 });
             };
 
-            exp.writeLoginBlock = function (data, cb) { // XXX restricted-registration
+            exp.writeLoginBlock = function (data, cb) {
                 if (!data) { return void cb('NO_DATA'); }
                 if (!data.publicKey || !data.signature || !data.ciphertext) {
                     console.log(data);
                     return void cb("MISSING_PARAMETERS");
                 }
+                if (['string', 'undefined'].indexOf(typeof(data.registrationProof)) !== -1) {
+                    return void cb("INVALID_REGISTRATION_PROOF");
+                }
 
                 rpc.send('WRITE_LOGIN_BLOCK', [
                     data.publicKey,
                     data.signature,
-                    data.ciphertext
+                    data.ciphertext,
+                    data.registrationProof || undefined,
                 ], function (e) {
                     cb(e);
                 });
diff --git a/www/common/sframe-common-outer.js b/www/common/sframe-common-outer.js
index f4c0b7bd6..dde533e9f 100644
--- a/www/common/sframe-common-outer.js
+++ b/www/common/sframe-common-outer.js
@@ -1557,7 +1557,7 @@ define([
             });
 
             sframeChan.on('Q_CHANGE_USER_PASSWORD', function (data, cb) {
-                Cryptpad.changeUserPassword(Cryptget, edPublic, data, cb); // XXX restricted-registration
+                Cryptpad.changeUserPassword(Cryptget, edPublic, data, cb);
             });
 
             sframeChan.on('Q_WRITE_LOGIN_BLOCK', function (data, cb) {
diff --git a/www/settings/inner.js b/www/settings/inner.js
index 4ffdfe530..758b90069 100644
--- a/www/settings/inner.js
+++ b/www/settings/inner.js
@@ -593,7 +593,6 @@ define([
         $(form).appendTo($div);
 
         var updateBlock = function(data, cb) {
-// XXX restricted-registration registered users should be able to change their password even if registration is closed. Include proof of ownership of their existing block when requesting the creation of a new one
             sframeChan.query('Q_CHANGE_USER_PASSWORD', data, function(err, obj) {
                 if (err || obj.error) { return void cb({ error: err || obj.error }); }
                 cb(obj);