Make redirect uri optional as per spec

Feel free to reject this PR if you think that it causes too many security problems, but we had need for the behaviour of having the redirect URI being optional, as in issue https://github.com/applicake/doorkeeper/issues/68

I've made it configurable, defaulting to off. If you switch it on, you may:
 * Specify a redirect uri in the application AND the client, in which case they must match exactly
 * Specify no redirect uri in the application, in which case it will redirect to wherever the client provides
 * Specify no redirect uri in the client, in which case it will redirect to the value stored for the application

Best,
Hugh