Extracting access_token from popup URL query string includes hash in property name

[photomoose]

After a successful authentication with Identity Server, the popup window is redirected with the access_token being a hash fragment in the URL rather than a query parameter.

aurelia-authentication appears to not consider hash fragments and so the '#' character is included in the property name of the resulting object when the URL is parsed:

This is preventing aurelia-authentication from being able to extract the access_token.

aurelia-auth, on the other hand, seems to have this covered:
https://github.com/paulvanbladel/aurelia-auth/blob/3794943c53e70ace74c05c5e574a0e511383edf3/src/popup.js#L80