The aud in a json web token can be a string or an array -- so also deal with the case that it is an array

spiffworkflow-backend/src/spiffworkflow_backend/services/authentication_service.py

@@ -169,10 +169,8 @@ class AuthenticationService:
         iat = decoded_token["iat"]
         if iss != cls.server_url():
             valid = False
-        elif aud not in (
-            cls.client_id(),
-            "account",
-        ):
+        elif aud not in (cls.client_id(), "account") and\
+                aud != [cls.client_id(), "account"]:
             valid = False
         elif azp and azp not in (
             cls.client_id(),