Revert pull request #10 (multiple audiences) (#24)

Per #23, PR #10 (unreleased) made the authorization properties of
Claims.Validate more relaxed. Given that people may have been relying on
those authorization properties, we shouldn't make that change without a
change in API surface or a major version bump.

jwt/validation.go

@@ -89,16 +89,11 @@ func (c Claims) ValidateWithLeeway(e Expected, leeway time.Duration) error {
 	}
 
 	if len(e.Audience) != 0 {
-		flag := false
 		for _, v := range e.Audience {
-			if c.Audience.Contains(v) {
-				flag = true
-				break
+			if !c.Audience.Contains(v) {
+				return ErrInvalidAudience
 			}
 		}
-		if !flag {
-			return ErrInvalidAudience
-		}
 	}
 
 	// validate using the e.Time, or time.Now if not provided

jwt/validation_test.go

@@ -44,17 +44,6 @@ func TestFieldsMatch(t *testing.T) {
 		assert.NoError(t, c.Validate(v))
 	}
 
-	claimsWithSingleAudience := Claims{
-		Issuer:   "issuer",
-		Subject:  "subject",
-		Audience: []string{"a1"},
-		ID:       "42",
-	}
-
-	for _, v := range valid {
-		assert.NoError(t, claimsWithSingleAudience.Validate(v))
-	}
-
 	invalid := []struct {
 		Expected Expected
 		Error    error