Check that symbols such as "+" in the token are properly percent-encoded in the URL.