use RFC 4648 base64url encoding