use HTTPS URLs for all submodules