a. Why does Hybridauth login with facebook add #= to the url after a successful login?
and
b. Can it be removed?
This is not a Hybridauth issue, its a 'by design' implementation in the Facebook OAuth flow. Check this SO question for more detailed information.