Have the vapid `aud` check compare against endpoint_hostname

[jrconlin]

while hostname and endpoint_hostname are usually the same, it's a better idea to check against endpoint_hostname.