use url_for instead of basic redirect