Bug fix for commit API commit b537de085422827887c07d0258a3d3c1df17678e

The previous commit https://github.com/remy/jsbin/commit/b537de085422827887c07d0258a3d3c1df17678e#L3R67 resulted in the API not being available to authenticated users.  The statement if (allowAnonymous) around the route prevented the route being available.  It is unnecessary to enforce this at a routing level as the middleware https://github.com/remy/jsbin/blob/b537de085422827887c07d0258a3d3c1df17678e/lib/middleware.js#L209 prevents API write requests without correct authentication.
Store user against bin even if allowAnonymous is true

Previously because an API key was only validated if allowAnonymous was true, an invalid API key could be provided and the request would have been accepted, and also if a valid API key was provided it was not used to authenticate the user.
Ensure API authenticated users own their bins

Previously the API key was used for authentication to allow non anonymous API access, however the bin created was not marked as owned by that user.
Clearer naming for api options allowAnonymousRead[Write]
Allow any config property to be overridden with Env var

Using format JSBIN_[KEY]_[KEY]=whatever

for example the following config setting:
   {
     "url": {
       "host": "localhost:3300"
     }
   }
can be overriden with the following environment variable set
JSBIN_URL_HOST=my.url.com
resolve merge conflict
Bug fix for commit API commit b537de085422827887c07d0258a3d3c1df17678e

The previous commit https://github.com/remy/jsbin/commit/b537de085422827887c07d0258a3d3c1df17678e#L3R67 resulted in the API not being available to authenticated users.  The statement if (allowAnonymous) around the route prevented the route being available.  It is unnecessary to enforce this at a routing level as the middleware https://github.com/remy/jsbin/blob/b537de085422827887c07d0258a3d3c1df17678e/lib/middleware.js#L209 prevents API write requests without correct authentication.
Store user against bin even if allowAnonymous is true

Previously because an API key was only validated if allowAnonymous was true, an invalid API key could be provided and the request would have been accepted, and also if a valid API key was provided it was not used to authenticate the user.
Ensure API authenticated users own their bins

Previously the API key was used for authentication to allow non anonymous API access, however the bin created was not marked as owned by that user.
Clearer naming for api options allowAnonymousRead[Write]
Allow any config property to be overridden with Env var

Using format JSBIN_[KEY]_[KEY]=whatever

for example the following config setting:
   {
     "url": {
       "host": "localhost:3300"
     }
   }
can be overriden with the following environment variable set
JSBIN_URL_HOST=my.url.com
Ensure API is stateless (no session cookie)
Merge branch 'api-fixup' of github.com:ably-forks/jsbin into ably-forks-api-fixup
Merge branch 'ably-forks-api-fixup'
asthetics
3.6.0
Merge branch 'master' of github.com:remy/jsbin