use ApiController#anonymous_access_allowed?

There are some places where we only want to require login unless you can use EIP anonymously. So far we had an anonymous_certs_allowed? method in all these controllers. Now it's replaced with ApiController#anonymous_access_allowed?. The naming better reflects that there might be other services that allow anonymous use at some point.

This also fixed a typo name -> @filename that broke the ConfigsController.
features for anonymous use and service endpoint

Also moved the location of the config files into a configuration setting.