hex encode token instead of base64 to workaround "+" encoding issue