Please let me know if you think of any vulnerability with the approach of using a URL hash to store the key. Thanks a ton!