[security] TokenFactory accepts urls as targetPath and afterPath.

it fixes https://github.com/Payum/Payum/issues/117