fix up audience extractor for fxa & persona

* Pulled out audience from assertion to own function
* Now handles fxa "audience" and persona "aud"
* correct default audience url