Use SecureRandom.urlsafe_base64 for authenticity_token.

If `base64` is used the authenticity_token can include '+', a character that is not URL-safe.

The authenticity_token can cause problems when it includes a plus sign, because if it's encoded as a space the request can't be verified.

Using the `urlsafe_base64` method the authenticity_token will only include A-Z, a-z, 0-9, - and _ making it URL-safe when sent in any form params.