? would leak the key to the server

# would hide it

I normally dont like # in URIs but this is one case where it works