use https for submodules to prevent login