Make redirect uri optional

... as long as one is provided by either the client or the request

As per [section 4.2.1 of the spec](http://tools.ietf.org/html/rfc6749#section-4.2.1), the redirect uri can be either registered on the server, or passed in by the client. If both are required, they must match.

Doorkeeper right now forces both to be passed in, see https://github.com/applicake/doorkeeper/issues/68

This is more secure against tampered-with redirects, but doesn't work well with the ability to spin up test boxes which need to authorize against our staging oauth.

So I've added this to give us the optional ability to allow the original spec behavior.

@Ofanite 
@tannerburson