I don't understand how anyone would be able to share regtokens? You use the regtoken to uniquely identify your user, so then also validating a serial number as a secondary authentication after the first one passes sounds redundant to me. If it's a private channel you're working on then you don't need to worry about anything though, and if they decide your public channel needs the code changed, you'll need to do that.
