Add issuer, audience and azp checks in bearer token validator

[julien-nc]

The bearer token validation is less complete than the login controller one.

• add issuer, audience and azp (authorized party) checks in bearer token validator
• make it possible to disable bearer token audience check via config.php.

closes #856