A couple no card up front fixes

When creating a new subscription without a token, Cashier was attempting to load the last four of the user's default card which obviously didn't exist. The error below was showing on subscribe.

    Unrecognized request URL (GET: /v1/customers/cus_xxxxxxxxxxxxxx/cards/). Please see https://stripe.com/docs or we can help at https://support.stripe.com/.

Also set `$token` to default null so no card up front subscriptions can be created with just `create()` instead of `create(null)`.