using read-only url for submodule to avoid requiring ssh access to github