Make client.audience_for a one-to-one relationship

This will allow us to validate a redirect_uri given a scope
unambiguously which is needed for the implicit grant flow.