hmmm.

Important: All encoding in TBA (Token Based Auth) is percent encoding. Strings must be escaped using RFC 3986. If you do not escape characters in the header, you may receive an INVALID_LOGIN_ATTEMPT error. For more information about percent encoding, go to https://tools.ietf.org/html/rfc5849#section-3.6

Thanks for the feedback @zjones but I am following the RFC 3986 spec. I have a case open with support, it's just day 7 and no resolution. If they come back with something, I'll update the thread. Thanks again