some frameworks, such as angular may append a '/' after the # during the implicit flow, so
check for a leading / and strip it out when looking for the #access_token hash fragment