Ensure that default "audience" URL has no path component.

The latest verifier is very strict about the format of the "audience" URL - it now enforces that it has a valid scheme, has no path component, etc.  We need to take a bit more care when deriving the default audience from the public_url.

@callahad r?