code: String jwtAudienceElementCheck(List<String> allowedAudiences, List<String> audiences) {
          if (allowedAudiences == null) { // handle Point A.
              for (String audience : audiences) {
                  if (oidcClientRequest.isPreServiceUrl(audience)) {
                      return audience;
                  }
              }
              return null; // Point B.
          }
          // Point B.
          for (String audience : audiences) {
              for (String allowedAud : allowedAudiences) { // this is not null when created in the configuration instnce
                  // ALL_AUDIENCES.  Point D.
                  if (allowedAud != null && allowedAud.equals(audience))
                      return audience;
              }
          }
          return null;
      }
docs: A. If JWT contains "aud", and one or more "aud" starts http or https,
  and resources service URL contains the "aud" (and audiences is not configured), it is considered matched. JWT will be
  accepted.
  In other words, if "aud" is URL, "audiences" configuration is not required. However, if audiences is configured, the exact
  matching is required, and resource service URL matching is not performed.
  B. If JWT contains "aud", and openidConnectClient does not config "audiences", or configured "audience" do not match, it is
  an error condition.
  C. if JWT does not contain "aud", but openidConnectClient contains "audiences", it is an error condition.
  D. ALL_AUDIENCES can be specified to ignore audience check.
  
  @param allowedAudiences
  @param audiences
  @return