Validate function should verify domain as expected.

[johnny-linkedin]

According to the doc verify the domain, the validate function should also verify domain of amurl to make sure the JWT is signed by Exchange server.

Outlook-Add-In-Token-Viewer/TokenValidationService/Models/ExchangeIdToken.cs

Line 43 in 535ceaf

public IdTokenValidationResult Validate(string expectedAudience)