App fails to logout with access_token in url

[givensuman]

After logging in, the user is brought to the <Profile /> component and the url is set to something like https://spotify-profile.herokuapp.com/#access_token=BQBkftL1q6csOOMYZojUD...

Hitting 'Logout' from here refreshes the page with the profile still loaded. To get around this, one can navigate to any page and back to their profile to have the url reset without the access_token query present. When it's gone, the Logout button works again.

I think it's because in the server's index.js there is:

 res.redirect(
            `${FRONTEND_URI}/#${querystring.stringify({
              access_token,
              refresh_token,
            })}`,
          );

and the only path back to / is in the Nav.js component:

<NavLink to="/">
    <IconUser />
    <div>Profile</div>
</NavLink>