Bug 1023296 — Accept multiple FxA audiences.

https://bugzilla.mozilla.org/show_bug.cgi?id=1023296
I'd make a slight tweak to this. Instead of setting `audience` to the audience extracted from the assertion (which if there was a bug here, you'd accept any assertion you're given), I'd set it to the audience value that you matched against in the list of trusted audiences. 

e.g,

```
var trustedAudienceIndex = audiences.indexOf(assertionAudience);
if (trustedAudienceIndex !== -1) {
  audience = audiences[trustedAudienceIndex];
}
```

Maybe with a comment explaining why it's done this way. :)