Preserve entropy in TokenGenerator

base_convert loses precision on large inputs. Use URL-safe base64_encode instead.