You don't actually need the pull-up resistor as there's one built in already. The pull-up is activated by setting the USB_PU bit in the SYSCFG register. See section 8.5.2 of RM0038.
Edit: Oh, and regarding the bootloader, make sure you have pull ups or pull downs on all the other I/O lines that the bootloader will try (CAN, USART, etc.).