Base64 encode frontend callback url

It might be safer to base64 encode the frontend callback URL. This patch makes this optional to the user so it should still be backwards compatible for people using an unencoded parameter.