RFC4648 defines a URL-safe base64 encoding which they say can be referred to as "base64url":
http://tools.ietf.org/html/rfc4648#section-5
Newer Apache Codec (1.9) includes support for a constructor override for Base64 that specifies it should be "web-safe", which AFAICT means it uses the 'base64url' encode/decode.
The following attached patch (which has some formatting issues, I'm rusty on SVN), switches to using codec 1.9 (pulled from the tags/1.9 SVN branch of apache-codec, and then minor changes to make Java 1.4 compatible (removing annotations, and not using an enhanced for-loop)), and then updates the various String PBE classes to handle appropriately.
With this change, a more compact base64 encoding can be used for things getting put into HTTP headers, query parameters, etc.
Thanks in advance,
-pete