A team uses tokens for cross-service authentication. Why must the receiving service validate the token's intended audience and trust configuration?

1. Validation is unnecessary once the request contains a username
2. Any token from any source is valid on a private network
3. Audience validation only changes how the login screen looks
4. A token issued for another service should not automatically authorize this service