Explicitly set token_audience for Session

This MR closes #42 (closed) by backporting a fix from main onto the release/1.1.x branch.