[Bugfix] fix security token comparison when using urlencoded characters