Fronts admin: query/pushstate sets displayed blocks

URLs that specify which trailblocks to render now survive an OAuth handshakes, because they use a query string param instead of the hash fragment.