Here we check if the user is logged into the current origin.  If so, we will get a silent assertion below for the *preferred* origin specified in `options`.  In the case of rtc, this will be `rtcweb://peerconnection`.  The thinking here is that if Alice has visited ekrpokr.com, a site that facilitates the establishment of rtc video chats, then Alice wants an rtc peer connection verified by the same identity she used to sign into ekrpokr.com.  Therefore the user agent switches the audience in the assertion.  Additionally, the one-time unique peer-connection key fingerprint is embedded in the assertion (`payload.extra`), which prevents replay attacks.)