Hack in registration prevention

app/controllers/users_controller.rb

@@ -26,7 +26,10 @@ class UsersController < ApplicationController
     @user = User.new(user_params)
 
     respond_to do |format|
-      if @user.save
+      if ENV["REGISTRATION_ALLOWED"].blank?
+        format.html { redirect_to new_session_url, alert: "Registration disabled." }
+        format.json { render json: @user.errors, status: :unprocessable_entity }
+      elsif @user.save
         @session = Session.new(session_params).save
         session[:current_user_id] = @session.user_id