Supply 'aud' in the stream creation POST request

[FragLegs]

I am proposing that, when creating a new stream, the receiver should pass the aud value, instead of assuming the transmitter already knows it.

This issue is specifically tied to the work being done in Issue #4 and PR #9. Prior to PR #9, a stream was created by default when the transmitter/receiver relationship was established. The mechanism by which that relationship is created is not described in the SSE spec, but it involved sharing some information between the receiver and the transmitter. Specifically, the transmitter and receiver must both know the bearer token used for authenticating requests and the aud value that is added to all events in the stream.

With PR #9 in place, there is no default stream in place between a receiver and a transmitter. Instead, a receiver creates streams by calling the configuration_endpoint [POST] endpoint. The receiver must have a bearer token in order to call that endpoint, so some out-of-band communication is still required, but we could reduce the amount of out-of-band information passing by having the aud parameter be a part of the information sent in that POST call.

[timcappalli]

on 2023-03-21 call: @timcappalli to think about before next call

[independentid]

My use cases require that iss and aud be specifiable by the requesting SSF client.

For example, there may be multiple aud in use at a transmitter. How would the transmitter know which audience the receiver wants?

[tulshi]

I don't know if we can work on this now that ID-2 has shipped. I'd like to know everyone's thoughts here.

[FragLegs]

Closing as the general consensus has become that the transmitter should generate the aud value for security reasons.