base64url: trap bad chars more predictably in decode