Why is `login.persona.org` a special audience in this case? (I'm not saying it's wrong, I just don't understand it...)