[bug 1059826] Add max_length to url field in API

The max length makes sure DRF is validating the url field data against
an implicit max length because we're using Django's URLField in the
model.

This also adds a test so we don't mess this up in the future.

r?