use base64_encode/decode instead of url encode