Fix bug: use url_for() instead of handcrafted url

Handcrafted url would render wrong urls

Signed-off-by: Lance Chen <cyen0312@gmail.com>