Extract the password reset url into a method

(There will be conflicts when merging this PR with the current master. I will submit a PR that is automatically mergeable later unless there are objections to this change.)

This makes it easier for sites with dynamic subdomains to submit the
correct url in the password reset email without copying any code from
oscar.