tokenString now works and is URL safe