extract VALID_RESPONSE_TYPES
Make client.audience_for a one-to-one relationship

This will allow us to validate a redirect_uri given a scope
unambiguously which is needed for the implicit grant flow.
Merge pull request #9 from davidlmorton/master

Make client.audience_for a one-to-one relationship
Merge remote-tracking branch 'origin/master' into add-implict-flow
bugfix: audience_for can be null now