secureURLs can not encode hash(#) string.