Fixed secure form hash for special url.

No htmlspecialchars encode and without fragment identifer.
Removed unnecessary conditional branch, fixed test and comment.
Add additional test case for named parameters.

Refs #3525
Merge branch 'secure-form-url-special'

Merge pull request #3525 into master. This fixes additional issues with
form tampering prevention by accomodating more URL types.