use url_for instead of manually constructed url