Notes service policy.

Accept only when all of these hold:
  the signature checks under the service's allowed algorithm
  iss is lab
  aud is notes

RFC 7519 section 4.1.3: when aud is present, each principal intended to process the JWT must identify itself with a value in aud. If it does not, the token is not for that principal.