return errorForbidden when anonymous user tries to create freeUrl pad (closes #1499)

Signed-off-by: Lucas Druschke <ldruschk@posteo.de>

lib/note/index.js

@@ -61,6 +61,8 @@ async function showNote (req, res) {
     // if allow free url enable, auto create note
     if (!config.allowFreeURL || config.forbiddenNoteIDs.includes(noteId)) {
       return errorNotFound(req, res)
+    } else if (!config.allowAnonymous && !userId) {
+      return errorForbidden(req, res)
     }
     note = await createNote(userId, noteId)
   }