use https submodules only