Remove <base>

Note: this doesn't remove the null domain, this is now set as the runner: null.jsbin.com - but null.jsbin.com/runner *does* serve the correct file, and everything is else returned a 204 - so we're still protected.

Fixes #1896
Fixes #1954
Fixes #2012