Ensure the token is always URL friendly

Email addresses with a + in them were generating a token with an
unescaped forward slash, which messed up the routes for Rails apps