make the url a required field for issuer

this one bites us a lot. It makes invalid assertions if you don't include an issuer url.