Force audience to incoming host when `checkAudience` is false

When the `checkAudience` option is false, we need to force our audience to the incoming host, otherwise passport will fail all requests with a miss-matched audience.

Alternatively, this could be the default if `checkAudience` was false, and `audience` was undefined, but It made sense to me to depend on `checkAudience` alone.

This allows, for example, development on localhost, while testing with another computer browsing to the site via ip address. (I frequently test with my iPad this way).