Fixed secure form hash for special url.
No htmlspecialchars encode and without fragment identifer.