fix($browser): account for IE deserializing history.state on each read

IE 10-11+ deserialize history.state on every read, causing simple comparisons
against history.state always return false. Account for that caching
`history.state` on every hashchange or popstate event.

Also, prevent firing onUrlChange callbacks twice if both popstate and hashchange
event were fired.

Closes #9587
Refs #9545