use Base64.urlsafe_encode for token generator; reorganise web files