indicate clearly that URL safe base64 encoding is preferred

[Geal]

the different base64 alphabets might be confusing

[divarvel]

All mentions of base 64 in the specification are explicit about using the URL-safe base 64 version.

I think the issue might not be the spec itself, but implementations that don't provide base 64 encoding directly and let users handle it themselves.