Made client optional for password grant type

This pull request is an attempt to bring Doorkeeper more in line with the OAuth 2.0 spec, specifically [section 4.3](http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-4.3). It should address issue #288.

The `client_id` and `client_secret` parameters are no longer required when creating an access token using the Resource Owner Password Credentials flow.

```
   grant_type
         REQUIRED.  Value MUST be set to "password".
   username
         REQUIRED.  The resource owner username, encoded as UTF-8.
   password
         REQUIRED.  The resource owner password, encoded as UTF-8.
   scope
         OPTIONAL.  The scope of the access request as described by Section 3.3.
```

Consequently, the relationship between the access token and application models was changed, by removing the hard dependency between the two.