Add an option to specify the client domain requesting authentication

### Problem

If you have an Ajax frontend served from `domain.com`, and you serve your api from `api.domain.com` (instead of `domain.com/api`; this lets you have a lighter server for static frontend code), BrowserID login requests will fail because the audience for verification will not match the audience set in the assertion: the frontend is the one requesting the assertion, and the backend is the one requesting assertion verification.

### Solution

Add an option to Flask configuration, letting you specify the url at which the frontend is served. (I haven't added documentation or tests for that.)