allow decoding url-safe base64 space and slash