Replace hard-wired urls with `url_for` calls