use url helpers so SSL works in prod