'Ensure that access tokens issued via client credentials grant are associated with the owner of the
``Application``.'

def save_bearer_token(self, token, request, *args, **kwargs):

    grant_type = request.grant_type
    user = request.user
    if (grant_type == u'client_credentials'):
        request.grant_type = None
        request.user = request.client.user
    super(EdxOAuth2Validator, self).save_bearer_token(token, request, *args, **kwargs)
    is_application_restricted = RestrictedApplication.objects.filter(application=request.client).exists()
    if is_application_restricted:
        access_token = AccessToken.objects.get(token=token[u'access_token'])
        utc_now = datetime.utcnow().replace(tzinfo=utc)
        expires_in = (access_token.expires - utc_now).total_seconds()
        assert (expires_in < 0)
        token[u'expires_in'] = expires_in
    request.grant_type = grant_type
    request.user = user
