@Test
public void shouldDenyIncorrectAudience() {

  idTokenPayload.setAudience("https://foo.example.net");
  idTokenPayload.setEmail("foo@foo.iam.gserviceaccount.com");
  assertThat(validator.authenticate("token"), is(nullValue()));
  verifyZeroInteractions(projectsGetAncestry);
  verifyZeroInteractions(iam);
}