Use only web safe characters in client state arg

Fixes #268