more flexible capability string
use b64 encoding for auth transactions