Your registry is private to any apps signed by the same private key when packaging. So you only have to worry about registry namespace conflicts between apps that you've signed.
If the user cancels service on your site, your site would no longer let the Device Service Token pass the authentication. This is usually implemented in your services by deleting the row with a matching token.
You've got the right idea about having the server side authentication and if not authenticated doRegistration(). This authentication piece is not in the registration example and would need to be added to a real app.
--Kevin
