so the recommendation is that if you've got non-alphanum things (like email addresses) that you base64-encode them on the way in and out