Comment by slavomirvojacek

Hi, just for completeness - the decryption key is added to the secret URL as a fragment in the penultimate step.