use HTTPS URLs for submodules