fixing issue #97

Now able to merge as well.
You can simplify all this and just do:

```js
var allowQueryString = env.get("ALLOW_QUERY_STRING_API_SYNC" || false);
...
if( !username && allowQueryString ) {
...
```