switched to URL safe base64 encoding (RFC 4648)