I've never found it useful that parts after # in url is not sent to server. Now I do, it should never be removed. This is perfect way to add a decryption key as demonstrated.