Information disclosure fix

Basically the blocker. Use hash (note to self : see findit code) instead of any of the IDs in the URL.