Making UrlHelper's methods virtual

/cc: @rynowak @yishaigalatzer 
given that this has security implications I'm not sure we want to make it virtual. I know the user could already replace this because it's an interface, but it feels wrong to encourage it.