base64 encoding rules should be better specced

[mcarter]

It would be good to nail down the browser encoding rules so we can not send base64 everywhere