Thanks! I figured you would be doing the decent thing (ie not listening in!). All the best with the project!
FYI this is now deployed and live, the privacy point was huge and I wanted to make it clear that this is CSR only, and the # was perfect. Now if you route to a legacy path i.e. without a #, you will be redirected to the memlink protected behind the #.
I will still work on a privacy policy that outlines these things :) Thank you again for the great feedback.