Handle keycloak redirects with an existing routing hash

The keycloack token doesn't have to be the first thing in the hash
so don't assume it starts with a #

packages/auth/src/vpu-auth.js

@@ -68,7 +68,7 @@ class VPUAuth extends LitElement {
         }
 
         // load Keycloak if we want to force the login or if we were redirected from the Keycloak login page
-        if (this.forceLogin || (href.indexOf('#state=') > 0 && href.indexOf('&session_state=') > 0)) {
+        if (this.forceLogin || (href.search('[&#]state=') >= 0 && href.search('[&#]session_state=') >= 0)) {
             this.loadKeycloak();
         }