Currently they're like population#login#token

When embedded in URL they need to be URL-encoded/decoded

I'd prefer that the entire token is encoded, e.g. in base64