more efficent and uri decode of hash tokens per https://developers.google.com/accounts/docs/OAuth2UserAgent#handlingtheresponse