audience list

[lelongg]

Besides formatting, this commit handles aud claims containing and array instead of only a single value.
Formatting related commits are separate, it should ease review.

From https://tools.ietf.org/html/rfc7519

4.1.3. "aud" (Audience) Claim

In the general case, the "aud" value is an array of case-
sensitive strings, each containing a StringOrURI value. In the
special case when the JWT has one audience, the "aud" value MAY be a
single case-sensitive string containing a StringOrURI value.