Decode location.hash before using

This fixes #41 for Safari, while I'm still not sure whether it's doing the wrong thing or the right thing with regards to this (?).

Calling decodeURIComponent() on the hash in Chrome, Firefox & Opera (which have all decoded the hash before returning it) doesn't have any sideeffects, it seems.