Change hardcoded links to url_for()

Fixes #40