Thanks for your answer.
If I only use url="..." and token="..." without UrlEncoding, special characters (/ and +) are directly put in the url. So, I get the error :
javax.servlet.ServletException: Input length must be multiple of 8 when decrypting with padded cipher
Actually, I use an authentification filter underlying the rest API of ArcGIS Server, writter in Java. So I have to modify it.
Thanks.