Made client optional for password grant type

AccessToken now has an optional association with Application