spec: change mktemp --tmpdir -> $TMPDIR
Web.JSON: fix decode() for special tokens