Use shorter tokens

Use URL-safe Base 64 encoding instead of hyphenated hexadecimal.

These preserve security (in fact, improve it slightly, with 2^128 bits of entropy as opposed to 2^122 for a v4 UUID) but take less space in the email, and there's less to type if you need to do that.

@jaikoo does this need to be signed off by someone responsible?

@Najaf does this look OK to you?