Handle keycloak redirects with an existing routing hash

The keycloack token doesn't have to be the first thing in the hash
so don't assume it starts with a #