Meant more when application_id and resource_owner_id not set, but I guess that would be the client credential flow, etc.  Also looks like application_id will always be set by the time this method is called.