There should be a validation of the provided user-name in registration. It would be good idea for them to contain only save for location names symbols since they are going to be used for ResourceRefR4. The validation should be using a common method from the RequestHandlerUtil.
The getSession() method should check if the smtp host, mail or password are null and provide the user with a message. The change of the pasword should be done last after the message is send. This way if for some reason the message is not send the password will not be changed.
The email should be validated by a pattern matcher ".+@.+
.[a-z]+".
Change the getTitle method of the UserH to use the user-name of the user if there is no screen name set. This could be extracted since it is the last part of the resource ref to the user.
There are two messages that require arguments - for invalid user and invalid email. They should be added with additional argument.