submodules need not be https