Allow CustomerToken to be created without a User

[rossp]

The CustomerToken model is currently tied to a User. Although Pin require an email address, this might not come from a User record in Django so it may as well be uncoupled. I'd spoken to someone years about this where they wanted a CustomerToken attached to a company or subscription which wasn't tied to a user.

(This has come out of my cursory review of this project, wanting to bring it up to date again)