Validating idToken and callback makes sense, but the audience is optional in other G+ API's, happy to enforce it as a required field if you agree.