Hah. One of my first tasks when I started working at aD was writing a "registered users only" filter for ACS 1. I remembered to add an exception for /SYSTEM and /register along with a few other things (probably related to images) to avoid the kind of problem you mention. I've seen this exception be dropped from every version of (Open)ACS since.
