Move to a base64-based format in the URL for robustness.

This base64 format (with / and + swapped by _ and - respectively)
allows for a more robust URL that avoids misinterpretation (such as a
double-slash) from clients.

H/T to @meqif for this idea.