Bug fix for commit API commit b537de085422827887c07d0258a3d3c1df17678e

The previous commit https://github.com/remy/jsbin/commit/b537de085422827887c07d0258a3d3c1df17678e#L3R67 resulted in the API not being available to authenticated users.  The statement if (allowAnonymous) around the route prevented the route being available.  It is unnecessary to enforce this at a routing level as the middleware https://github.com/remy/jsbin/blob/b537de085422827887c07d0258a3d3c1df17678e/lib/middleware.js#L209 prevents API write requests without correct authentication.
Store user against bin even if allowAnonymous is true

Previously because an API key was only validated if allowAnonymous was true, an invalid API key could be provided and the request would have been accepted, and also if a valid API key was provided it was not used to authenticate the user.
Ensure API authenticated users own their bins

Previously the API key was used for authentication to allow non anonymous API access, however the bin created was not marked as owned by that user.
Clearer naming for api options allowAnonymousRead[Write]
Allow any config property to be overridden with Env var

Using format JSBIN_[KEY]_[KEY]=whatever

for example the following config setting:
   {
     "url": {
       "host": "localhost:3300"
     }
   }
can be overriden with the following environment variable set
JSBIN_URL_HOST=my.url.com
resolve merge conflict
Bug fix for commit API commit b537de085422827887c07d0258a3d3c1df17678e

The previous commit https://github.com/remy/jsbin/commit/b537de085422827887c07d0258a3d3c1df17678e#L3R67 resulted in the API not being available to authenticated users.  The statement if (allowAnonymous) around the route prevented the route being available.  It is unnecessary to enforce this at a routing level as the middleware https://github.com/remy/jsbin/blob/b537de085422827887c07d0258a3d3c1df17678e/lib/middleware.js#L209 prevents API write requests without correct authentication.
Store user against bin even if allowAnonymous is true

Previously because an API key was only validated if allowAnonymous was true, an invalid API key could be provided and the request would have been accepted, and also if a valid API key was provided it was not used to authenticate the user.
Ensure API authenticated users own their bins

Previously the API key was used for authentication to allow non anonymous API access, however the bin created was not marked as owned by that user.
Clearer naming for api options allowAnonymousRead[Write]
Allow any config property to be overridden with Env var

Using format JSBIN_[KEY]_[KEY]=whatever

for example the following config setting:
   {
     "url": {
       "host": "localhost:3300"
     }
   }
can be overriden with the following environment variable set
JSBIN_URL_HOST=my.url.com
Ensure API is stateless (no session cookie)
attempt to prevent jsbin from crash on ropy urls...
Fixed #819. Thowing exception when user had no bins
Fixed #819 - should have returned when no result
tweak tracking
Fixed #824
Fixed #820

Exception was being thrown, tip is now shown using the messaging system.
Fixed #821

Analytics was throwing exception
Fixed #778

Now shows "Saving..." if it can't complete the save process, rather than MASSIVE red alert.