force the matching 'aud' claim in create_jwt