install-by-homebrew: adding http is safer