Make sure AccessToken audit has a User

Doorkeeper::TokensController is using MetalController, rather than
ActionController, so we need to set up a few things there.
Use current_user for auditing

We want to use current_user (which is aliased in the API) for auditing, rather than model users, because the goal is to audit user actions. Users could take action on other users' stuff at some point (maybe an client application is shared?) and we don't want to mess up the audit trail. This makes auditing the AccessToken creation difficult because there is no current_user in that call. We still have the remote_ip, so we can track the client application's server down.