fix: jwt validation correctly compares the aud with both app id and auth origin

fix: jwt validation correctly compares the aud with both app id and auth origin #214