use urlsafe base 64 encode/decode for token value