stop referencing `env` in url_for

encapsulate env in the request so that we can eventually move away from
the env hash