Base 64 is fine - he just needs to url-encode the parameter.