address changes in recent JSHint versions

- be sneaky about assignment to global "app" and "env"
- disable the newly aggressive test for trailing whitespace
3.1.1 changelog
appease JSHint

`private` is only a reserved word in strict mode, so JSHint wants dot
notation for `env.opts.private`. whatever.
temporarily disable failing tests (#363)