some validation stuff; fixed getting hash from url