Fixed secure form hash for special url.

No htmlspecialchars encode and without fragment identifer. #3524