Feature/oauth sandbox

As mentioned in the last github commit message, approach is as follows:
1. add public field to Doorkeeper::Application
2. add resource_owner to Doorkeeper::OAuth2::Client and valid_for?(...) method that checks whether the user matches the owner if app is private
3. override Doorkeeper::OAuth::PreAuthorization's validate_client method to check client.valid_for?(...)

TODO: continue to investigate whether we can get the Doorkeeper guys to take a PR with this functionality.
Add comments briefly explaining reasons for the monkeypatching (or pointing to GH issues)