Fix security vulnerability in the hash URLs component

Sanitizes the window.location.hash before use
Update changelog and readme