Application is not required for access_token

As client authorization is now optional, we should accept the cases where application is nil.

When `reuse_access_token` is enabled per #383, if you [don't send client_id and client_secret](https://github.com/doorkeeper-gem/doorkeeper/issues/397), it was causing NoMethodError due to application being nil. This bug has been there before #383 but the feature shed light on it.

However, I'm still not sure if this is the best way to fix the issue, as it can create an access token even when you have an invalid pair of `client_id` and `client_secret` and now you get an access token for unknown application. I personally think that, if `client_id` and `client_secret` are given, that should be an error.

Until we decide what is right, this PR should provide a quick fix.