Flesh out protected_endpoint decorator

I'll continue to add to this pull-request.
I think we should only allow `aud` to be single valued in `WWW-Identify`, since it's probably weird for us to care about other services besides the one receiving the request being an audience.