According to the spec (5.4 Discovery Service Set):
A Client shall verify that:
a) The ApplicationUri specified in the Server Certificate is the same as the ApplicationUri provided in the EndpointDescription.
...
c) The EndpointDescriptions returned from the Discovery Endpoint are the same as the EndpointDescriptions returned in the CreateSession response.

But the spec also recommends to omit the ApplicationDescription in the 'serverEndpoints' parameter of the CreateSession response (5.6.2.2). This contradicts paragraph c) above:
It is recommended that Servers only include the endpointUrl, securityMode,
securityPolicyUri, userIdentityTokens, transportProfileUri and securityLevel with all other parameters set to null. Only the recommended parameters shall be verified by the client.

We should recommend also to return the ApplicationUri.