replace strtok with thread-safe strtok_r

This closes #112