Bug fix for commit API commit b537de085422827887c07d0258a3d3c1df17678e

The previous commit https://github.com/remy/jsbin/commit/b537de085422827887c07d0258a3d3c1df17678e#L3R67 resulted in the API not being available to authenticated users.  The statement if (allowAnonymous) around the route prevented the route being available.  It is unnecessary to enforce this at a routing level as the middleware https://github.com/remy/jsbin/blob/b537de085422827887c07d0258a3d3c1df17678e/lib/middleware.js#L209 prevents API write requests without correct authentication.
Store user against bin even if allowAnonymous is true

Previously because an API key was only validated if allowAnonymous was true, an invalid API key could be provided and the request would have been accepted, and also if a valid API key was provided it was not used to authenticate the user.
Ensure API authenticated users own their bins

Previously the API key was used for authentication to allow non anonymous API access, however the bin created was not marked as owned by that user.
Clearer naming for api options allowAnonymousRead[Write]
Allow any config property to be overridden with Env var

Using format JSBIN_[KEY]_[KEY]=whatever

for example the following config setting:
   {
     "url": {
       "host": "localhost:3300"
     }
   }
can be overriden with the following environment variable set
JSBIN_URL_HOST=my.url.com
resolve merge conflict
Bug fix for commit API commit b537de085422827887c07d0258a3d3c1df17678e

The previous commit https://github.com/remy/jsbin/commit/b537de085422827887c07d0258a3d3c1df17678e#L3R67 resulted in the API not being available to authenticated users.  The statement if (allowAnonymous) around the route prevented the route being available.  It is unnecessary to enforce this at a routing level as the middleware https://github.com/remy/jsbin/blob/b537de085422827887c07d0258a3d3c1df17678e/lib/middleware.js#L209 prevents API write requests without correct authentication.
Store user against bin even if allowAnonymous is true

Previously because an API key was only validated if allowAnonymous was true, an invalid API key could be provided and the request would have been accepted, and also if a valid API key was provided it was not used to authenticate the user.
Ensure API authenticated users own their bins

Previously the API key was used for authentication to allow non anonymous API access, however the bin created was not marked as owned by that user.
Clearer naming for api options allowAnonymousRead[Write]
Allow any config property to be overridden with Env var

Using format JSBIN_[KEY]_[KEY]=whatever

for example the following config setting:
   {
     "url": {
       "host": "localhost:3300"
     }
   }
can be overriden with the following environment variable set
JSBIN_URL_HOST=my.url.com
Ensure API is stateless (no session cookie)
Update Bootstrap css/js urls

dvi-
Add latest bootstrap too - 3.0.0rc1
3.5.10
Merge branch 'master' of github.com:remy/jsbin
Fix #765 and #793. Increase bin url length and posibilities.

The error was:

a) being caused by strings being passed up through the error handler - instead of actual error objects.
b) more importantly, the 10 tries jsbin was attempting to get a new bin id, it was failing!!!! so I've increased the chances by adding uppercase characters (doubling the possibilties) and on each hit on an existing bin, the shortcode will get longer
Merge pull request #796 from remy/fix/clone-server-error

Fix #765 and #793. Increase bin url length and posibilities.
Attempt to get better error reporting by putting sourceURL earlier
Fixed #788 and fixed #764. Add inline loop protection, handles do loops and // noprotect to exit loop protection