Disallow request-based audience (bug 896556)

... except when in development
Merge pull request #204 from kumar303/fix-aud

Disallow request-based audience anywhere but dev
Use the encrypted cookie key setting (bug 895634)