def authorized?
      return unless token.present?

      # Client is confidential, therefore client authentication & authorization
      # is required
      if token.application_id? && token.application.confidential?
        # We authorize client by checking token's application
        server.client && server.client.application == token.application
      else
        # Client is public, authentication unnecessary
        true
      end
    end
def authorized?
      return unless token.present?

      # Client is confidential, therefore client authentication & authorization
      # is required
      if token.application_id? && token.application.confidential?
        # We authorize client by checking token's application
        server.client && server.client.application == token.application
      else
        # Client is public, authentication unnecessary
        true
      end
    end
OAuth 2.0 Section 2.1 defines two client types, "public" & "confidential".
 Public clients (as per RFC 7009) do not require authentication whereas
 confidential clients must be authenticated for their token revocation.

 Once a confidential client is authenticated, it must be authorized to
 revoke the provided access or refresh token. This ensures one client
 cannot revoke another's tokens.

 Doorkeeper determines the client type implicitly via the presence of the
 OAuth client associated with a given access or refresh token. Since public
 clients authenticate the resource owner via "password" or "implicit" grant
 types, they set the application_id as null (since the claim cannot be
 verified).

 https://tools.ietf.org/html/rfc6749#section-2.1
 https://tools.ietf.org/html/rfc7009