Java Security

all:
iam unable to figure out if this is java issue or apache/tomcat issue..
I encode my long single use token and pass to a servlet. Before sending i print the token, its encoded. but the receiving servlet gets it as 'unencoded' and it fails..
eg:
my servlet prints below:
12:04:26:934 PM Encoded token: AQIC5wM2LY4Sfcx398HjS0rX5higXm92UJCcnh8VAKz%2BDgI%3D%40AAJTSQACMDE%3D%23
12:04:26:934 PM Trying URL:https://myMachine:58081/httpproxy/httpproxy?ReqType=RefreshToken&User=secuser&Token=AQIC5wM2LY4Sfcx398HjS0rX5higXm92UJCcnh8VAKz%2BDgI%3D%40AAJTSQACMDE%3D%23&Service=login

But the receiving servlet, prints this log
01/25/2008 11:47:27:725 AM EST: Thread[service-j2ee-36,5,main]
User=secuser token=AQIC5wM2LY4Sfcx398HjS0rX5higXm92UJCcnh8VAKz+DgI=@AAJTSQACMDE=#

As you can see the the receiving servlet gets the token value in un-encoded form..

I have tried so many things and am out of ideas.. appreciate greatly any pointers.

------- My servlet ----
import java.util.*;
import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;
import java.net.*;
import javax.net.ssl.*;
import javax.net.ssl.HttpsURLConnection;

public class RefreshTokenServlet extends HttpServlet
{
private String csdURL_ = "https://myMachinet:58081/httproxy/httpproxy";
public static final int TIMEOUT_IN_MILLISEC = 60000;
public static final String REQ_TYPE_PARAM="ReqType";
public static final String USER_PARAM="User";
public static final String TOKEN_PARAM="Token";
public static final String SERVICE_PARAM="Service";

public void init(ServletConfig config) throws ServletException
{
super.init(config);
} //end of init

public void destroy()
{
}

//This method called by get and post methods
protected void processRequest(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, java.io.IOException
{
String reqVal = request.getParameter(REQ_TYPE_PARAM);
String userVal = request.getParameter(USER_PARAM);
String tokenVal = request.getParameter(TOKEN_PARAM);
String serviceVal = request.getParameter(SERVICE_PARAM);

PrintWriter out = response.getWriter();

System.out.println("token as got: " + tokenVal); //<<<--- this is not encoded..

if ((reqVal == null) || (userVal == null) || (tokenVal == null)
|| (serviceVal == null) ) {
sendReply(out, "ERROR: Some Mandatory parameters are null");
}
String encToken = null;
try {
encToken = URLEncoder.encode(tokenVal, "UTF-8"); //<<<--- encoding
System.out.println("Encoded token: " + encToken);
}
catch (UnsupportedEncodingException uee) { }
StringBuffer dataS = new StringBuffer();
String sep = "&";
dataS.append(REQ_TYPE_PARAM).append("=").append(reqVal);
dataS.append(sep).append(USER_PARAM).append("=").append(userVal);
dataS.append(sep).append(TOKEN_PARAM).append("=").append(encToken); //<<-- using encoded token
dataS.append(sep).append(SERVICE_PARAM).append("=").append(serviceVal);

// String finalURLString = csdURL_ + "?" + dataS.toString();
String finalURLString = csdURL_;
URL url = new URL(finalURLString);
System.out.println("Trying URL:" + finalURLString);
//System.out.println("dataS :" + dataS.toString());
URLConnection servletConnection = url.openConnection();
if (servletConnection instanceof HttpsURLConnection) {
HttpsURLConnection x = (HttpsURLConnection)servletConnection;
x.setHostnameVerifier(
new HostnameVerifier()
{
public boolean verify(String urlHost,
SSLSession ssls)
{
return true;
}
}
);
}
// inform the connection that we will send output and accept input
servletConnection.setDoInput(true);
servletConnection.setDoOutput(true);
servletConnection.setUseCaches(false);
servletConnection.setConnectTimeout(TIMEOUT_IN_MILLISEC);
servletConnection.setReadTimeout(TIMEOUT_IN_MILLISEC);

// specify the content type
servletConnection.setRequestProperty(
"Content-Type", "application/x-www-form-urlencoded");

try {
DataOutputStream dout=new DataOutputStream(
servletConnection.getOutputStream());
dout.writeBytes(dataS.toString());
dout.flush();
dout.close();
}
catch ( IOException e ) {
String reason = "Exception :"+e.toString();
System.out.println(reason);
sendReply(out, reason);
throw e;
}

// Now, read the input from the servlet
DataInputStream dis = new DataInputStream(
servletConnection.getInputStream());
BufferedReader reader = new BufferedReader(new InputStreamReader(dis));
StringBuffer reply = new StringBuffer();
String s=null;
while ((s=reader.readLine())!=null)
{
if (s.length()!=0)
{
reply.append(s);
}
}
try {
reader.close();
dis.close();
}
catch (Exception exOnClose) { }

sendReply(out, reply.toString());
}

/**
* Method Name: doGet
*
* Description: This method handles http get request
*
* @param request
* @param response
* @return none
* @throws ServletException
* @throws IOException
*/
protected void doGet(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, java.io.IOException
{
processRequest(request, response);
}

/**
* Method Name: doPost
*
* Description: This method handles http post request
*
* @param request
* @param response
* @return none
* @throws ServletException
* @throws IOException
*/
protected void doPost(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, java.io.IOException
{
processRequest(request, response);
}

/**
* Method Name: getServletInfo
*
* Description: Returns a short description of the servlet.
*
* @param request
* @param response
* @return none
* @throws ServletException
* @throws IOException
*/
public String getServletInfo()

{
return "Posts refreshToken request to CSD servlet";
}

private String post(String url, String data)
{
return "";
}
private void sendReply(PrintWriter pw, String data)
{
pw.println(data);
pw.flush();
pw.close();
}
}