use urlsafe tokens