CORE: use base64 for URL safe cipher text