Don't set the audience via the request.

https://developer.mozilla.org/en-US/Persona/Security_Considerations says that's
bad.