I think we should either do validation or cleaning up of this field so we can ensure url-safe token values. Not sure if it needs to be done in this PR though.