That is, indeed, the crux of the problem. Anything after the hash is client-only.