Many people have been saying, use pushState rather than hashbang.
What I don't understand is, how would you be search engine friendly without using hashbang?
Scenario is thusly:
What about using the meta tag that Google suggests for those who don't want hash-bangs in their URLs:
<meta name="fragment" content="!">
See here for more info: https://developers.google.com/webmasters/ajax-crawling/docs/getting-started
Unfortunately I don't think NickC clarified the issue that I thought the OP was having. The problem is simply that we don't know who we are serving content to if we don't use the hash-bang. Pushstate does not solve this for us. We don't want search engines telling end-users to navigate to some URL that spits out unformatted JSON. Instead, we create URLs (that trigger other calls to more URLs) that retrieve data via AJAX and present it to the user in the manner we prefer. If the user is not a human, then as an alternative we can serve an html-snapshot, so that search engines can properly direct human users to the URL that they would expect to find the requested data at (and in a presentable manner). But the ultimate challenge is how do we determine the type of user? Yes we can possibly use .htaccess or something to rewrite the URL for search engine bots we detect, but I'm not sure how fullproof and futureproof this is. It may also be possible that Google could penalize people for doing this sort of thing, but I have not researched it fully. So the (pushstate + google's meta tag) combo seems to be a likely solution.