disallow hash in card names+discussion

dislike. workaround: don't hand-write urls with hashes in them.

or question marks or percent signs or....

closing. no way we want to disallow any character that can cause problems when unescaped.