Clarify audience requirements for senders and receivers

[selfissued]

Clarify that the audience sent must be a single value containing Entity Identifier of the recipient and that the only acceptable audience value to a recipient is its Entity Identifier, with no other audience values.

@jogu let us know that clarifying this will aid in effective certification testing.