Fix multiple occurences of `-` or `_` in tokens

String replacements replaced only the first occurence of `-` or `_` in tokens for base64 decoding, which meant that there was a base64 decode error if more than one of either was present in the base64url format. Use regexps in replacement instead to get a global match.
Add test case for two undescores in token value