use https for vcs
update composer lock with https