Broken base64 encoding for URL password parameter (shared secret) for SPA calls

[robintown]

Figured out what's happening: when converting to URL-safe base64 we're calling String.replace instead of String.replaceAll, which replaces only the first instance of + or / in the key.