submodules do now have a read-only URL