use base64 URL-safe codec