Extract the password reset url into a method

(I will submit a PR that is automatically mergeable later unless there are objections to this change.)

This makes it easier for sites with dynamic subdomains to submit the
correct url in the password reset email without copying any code from
oscar.