use url_for to generate urls instead of hardcoding them