switching dependency cloning to https, since it appears to be slightly more reliable, and is certainly not any less reliable or correct