rollupregistration.php - no auth checks

[danmarsden]

rollupregistration can be called without logging in or any capability checks - it also writes directly to a log file which could allow a malicious user to fill up diskspace with multiple calls.