user_id not required for authorization_code grant

Explained in #167