avoid passing query parameters to url_for (avoid hard-to-reproduce decoding issue)