By: Tom Sydney Kerckhove <syd@cs-syd.eu>
Refuse an empty issuer and an empty audience Both are names: an issuer is what something calls itself in iss, and an audience is what an issuer calls this service in aud. Nothing calls itself by nothing, so neither can be empty and still name anybody. A caller configured with an empty one would hold a Verification that refuses every token it is ever given, with nothing in the refusal to say that the configuration rather than the token was wrong. Saying so here means the caller is told when the configuration is read, which is the only moment anybody can act on it.