Include the intended audiences?

[Nat Sakimura]

At this point, it might be a good idea to include the following in the Request Object as the Client intent:

• Authorization Endpoint URI
• Token Endpoint URI
• (Resource Endpoint URI)

With it, it will be pretty secure.

[Nat Sakimura]

Fix #14

→ <<cset 7d944f599e19>>