use SecureRandom.urlsafe_base64

CSRF tokens can be used for OAuth redirect grants, so it is helpful if the token is url safe.