fix urls to non-https