change utils.uid() to return url-safe chars. Closes #753